dissect.target 3.25.dev24__tar.gz → 3.25.dev26__tar.gz

{dissect_target-3.25.dev24 → dissect_target-3.25.dev26}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.25.dev24
+Version: 3.25.dev26
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later
@@ -23,7 +23,7 @@ License-File: LICENSE
 License-File: COPYRIGHT
 Requires-Dist: defusedxml
 Requires-Dist: dissect.cstruct<5,>=4
-Requires-Dist: dissect.database<2,>=1
+Requires-Dist: dissect.database<2,>=1.1.dev3
 Requires-Dist: dissect.eventlog<4,>=3
 Requires-Dist: dissect.evidence<4,>=3.13.dev2
 Requires-Dist: dissect.hypervisor<4,>=3.20
@@ -70,7 +70,7 @@ Requires-Dist: dissect.cim[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.clfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
 Requires-Dist: dissect.cramfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
 Requires-Dist: dissect.cstruct<5.0.dev,>=4.0.dev; extra == "dev"
-Requires-Dist: dissect.database[dev]<2.0.dev,>=1.0.dev; extra == "dev"
+Requires-Dist: dissect.database[dev]<2.0.dev,>=1.1.dev3; extra == "dev"
 Requires-Dist: dissect.etl[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.eventlog[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.evidence[dev]<4.0.dev,>=3.13.dev2; extra == "dev"

{dissect_target-3.25.dev24 → dissect_target-3.25.dev26}/dissect/target/loaders/itunes.py

@@ -146,7 +146,7 @@ class ITunesBackup:
     def _open_manifest_db(self) -> SQLite3:
         path = self.root.joinpath("Manifest.db")
         if not self.encrypted or self.manifest["Lockdown"]["ProductVersion"] < "10.2":
-            fh = path.open("rb")
+            fh = path
         else:
             key = self.key_bag.unwrap(self.manifest["ManifestKey"])
             fh = BytesIO(aes_decrypt(path.read_bytes(), key))

{dissect_target-3.25.dev24 → dissect_target-3.25.dev26}/dissect/target/plugins/apps/av/mcafee.py

@@ -96,8 +96,7 @@ class McAfeePlugin(Plugin):
         len_marker = len(self.MARKER_SUSPICIOUS_UDP_CONNECTION)
 
         for log_file in self.get_log_files():
-            with log_file.open() as open_log:
-                database = SQLite3(open_log)
+            with SQLite3(log_file) as database:
                 fields = defaultdict(dict)
                 fields_table = database.table(self.TABLE_FIELD)
 

{dissect_target-3.25.dev24 → dissect_target-3.25.dev26}/dissect/target/plugins/apps/av/sophos.py

@@ -78,8 +78,7 @@ class SophosPlugin(Plugin):
         """
         if self.target.fs.path(self.LOG_SOPHOS_HITMAN).exists():
             try:
-                fh = self.target.fs.path(self.LOG_SOPHOS_HITMAN).open("rb")
-                db = SQLite3(fh)
+                db = SQLite3(self.target.fs.path(self.LOG_SOPHOS_HITMAN))
                 alerts = next(filter(lambda t: t.name == "Alerts", db.tables()))
                 for alert in alerts.rows():
                     yield HitmanAlertRecord(

{dissect_target-3.25.dev24 → dissect_target-3.25.dev26}/dissect/target/plugins/apps/browser/chromium.py

@@ -158,7 +158,7 @@ class ChromiumMixin:
             seen.add(db_file)
 
             try:
-                yield user, db_file, SQLite3(db_file.open())
+                yield user, db_file, SQLite3(db_file)
             except FileNotFoundError:
                 self.target.log.warning("Could not find %s file: %s", filename, db_file)
             except DBError as e:

{dissect_target-3.25.dev24 → dissect_target-3.25.dev26}/dissect/target/plugins/apps/browser/firefox.py

@@ -170,7 +170,7 @@ class FirefoxPlugin(BrowserPlugin):
                 db_file = profile_dir.joinpath(filename)
 
             try:
-                yield user_details, db_file, SQLite3(db_file.open())
+                yield user_details, db_file, SQLite3(db_file)
             except FileNotFoundError:
                 self.target.log.info("Could not find %s file: %s", filename, db_file)
             except DBError as e:
@@ -673,9 +673,7 @@ def decrypt_master_key(key4_file: Path, primary_password: bytes) -> bytes:
     # Extract neccesary information from the key4.db file. Multiple values might exist for the
     # values we are interested in. Generally the last entry will be the currently active value,
     # which is why we need to iterate every row in the table to get the last entry.
-    with key4_file.open("rb") as fh:
-        db = SQLite3(fh)
-
+    with SQLite3(key4_file) as db:
         # Get the last ``item`` (global salt) and ``item2`` (password check) values.
         if table := db.table("metadata"):
             for row in table.rows():
@@ -693,40 +691,42 @@ def decrypt_master_key(key4_file: Path, primary_password: bytes) -> bytes:
         else:
             raise ValueError(f"Missing table 'nssPrivate' in key4.db {key4_file}")
 
-    if not master_key:
-        raise ValueError(f"Password master key is not defined in key4.db {key4_file}")
+        if not master_key:
+            raise ValueError(f"Password master key is not defined in key4.db {key4_file}")
 
-    if master_key_cka != CKA_ID:
-        raise ValueError(
-            f"Password master key CKA_ID '{master_key_cka}' is not equal to expected value '{CKA_ID}' in {key4_file}"
-        )
+        if master_key_cka != CKA_ID:
+            raise ValueError(
+                f"Password master key CKA_ID '{master_key_cka}' is not equal to expected value '{CKA_ID}' in {key4_file}"  # noqa: E501
+            )
 
-    decoded_password_check: core.Sequence = core.load(password_check)
-    decoded_master_key: core.Sequence = core.load(master_key)
+        decoded_password_check: core.Sequence = core.load(password_check)
+        decoded_master_key: core.Sequence = core.load(master_key)
 
-    try:
-        decrypted_password_check, algorithm = _decrypt_master_key(decoded_password_check, primary_password, global_salt)
+        try:
+            decrypted_password_check, algorithm = _decrypt_master_key(
+                decoded_password_check, primary_password, global_salt
+            )
 
-    except EOFError:
-        raise ValueError("No primary password provided")
+        except EOFError:
+            raise ValueError("No primary password provided")
 
-    except ValueError as e:
-        raise ValueError(f"Unable to decrypt Firefox password check: {e!s}") from e
+        except ValueError as e:
+            raise ValueError(f"Unable to decrypt Firefox password check: {e!s}") from e
 
-    if not decrypted_password_check:
-        raise ValueError(f"Encountered unknown algorithm {algorithm} while decrypting Firefox master key")
+        if not decrypted_password_check:
+            raise ValueError(f"Encountered unknown algorithm {algorithm} while decrypting Firefox master key")
 
-    expected_password_check = b"password-check\x02\x02"
+        expected_password_check = b"password-check\x02\x02"
 
-    if decrypted_password_check != expected_password_check:
-        log.debug("Expected %s but got %s", expected_password_check, decrypted_password_check)
-        raise ValueError("Master key decryption failed. Provided password could be missing or incorrect")
+        if decrypted_password_check != expected_password_check:
+            log.debug("Expected %s but got %s", expected_password_check, decrypted_password_check)
+            raise ValueError("Master key decryption failed. Provided password could be missing or incorrect")
 
-    decrypted, algorithm = _decrypt_master_key(decoded_master_key, primary_password, global_salt)
+        decrypted, algorithm = _decrypt_master_key(decoded_master_key, primary_password, global_salt)
 
-    block_size = 16 if algos.EncryptionAlgorithmId.map(algorithm) == "pbes2" else 8
+        block_size = 16 if algos.EncryptionAlgorithmId.map(algorithm) == "pbes2" else 8
 
-    return unpad(decrypted, block_size)
+        return unpad(decrypted, block_size)
 
 
 def decrypt_value(b64_ciphertext: str, key: bytes) -> bytes | None:

{dissect_target-3.25.dev24 → dissect_target-3.25.dev26}/dissect/target/plugins/apps/container/podman.py

@@ -175,7 +175,7 @@ class PodmanPlugin(ContainerPlugin):
         """
 
         try:
-            db = SQLite3(path.open("rb"))
+            db = SQLite3(path)
         except (ValueError, DBError) as e:
             self.target.log.warning("Unable to read Podman database %s: %s", path, e)
             self.target.log.debug("", exc_info=e)

dissect_target-3.25.dev26/dissect/target/plugins/os/unix/esxi/configstore.py

@@ -0,0 +1,83 @@
+from __future__ import annotations
+
+import json as jsonlib
+from typing import TYPE_CHECKING, Any
+
+from dissect.database.sqlite3 import SQLite3
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.plugin import Plugin, internal
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+    from dissect.target.target import Target
+
+
+class ConfigstorePlugin(Plugin):
+    """Plugin to interact with the ESXi configstore."""
+
+    __namespace__ = "configstore"
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+        self._configstore = None
+
+        # ESXi 7 introduced the configstore
+        # It's made available at /etc/vmware/configstore/current-store-1 during boot, but stored at
+        # the path used below in local.tgz
+        if (path := target.fs.path("/var/lib/vmware/configstore/backup/current-store-1")).exists():
+            self._configstore = parse_config_store(path)
+
+    def check_compatible(self) -> None:
+        if self.target.os != "esxi":
+            raise UnsupportedPluginError("ESXi specific plugin loaded on non-ESXi target")
+
+        if not self._configstore:
+            raise UnsupportedPluginError("ESXi configstore not found on target")
+
+    @internal
+    def get(self, key: str, default: Any = None) -> dict[str, Any]:
+        """Get configstore value for the specified key."""
+        return self._configstore.get(key, default)
+
+
+def parse_config_store(path: Path) -> dict[str, Any]:
+    with SQLite3(path) as db:
+        store = {}
+
+        if table := db.table("Config"):
+            for row in table.rows():
+                component_name = row.Component
+                config_group_name = row.ConfigGroup
+                value_group_name = row.Name
+                identifier_name = row.Identifier
+
+                if component_name not in store:
+                    store[component_name] = {}
+                component = store[component_name]
+
+                if config_group_name not in component:
+                    component[config_group_name] = {}
+                config_group = component[config_group_name]
+
+                if value_group_name not in config_group:
+                    config_group[value_group_name] = {}
+                value_group = config_group[value_group_name]
+
+                if identifier_name not in value_group:
+                    value_group[identifier_name] = {}
+                identifier = value_group[identifier_name]
+
+                identifier["modified_time"] = row.ModifiedTime
+                identifier["creation_time"] = row.CreationTime
+                identifier["version"] = row.Version
+                identifier["success"] = row.Success
+                identifier["auto_conf_value"] = jsonlib.loads(row.AutoConfValue) if row.AutoConfValue else None
+                identifier["user_value"] = jsonlib.loads(row.UserValue) if row.UserValue else None
+                identifier["vital_value"] = jsonlib.loads(row.VitalValue) if row.VitalValue else None
+                identifier["cached_value"] = jsonlib.loads(row.CachedValue) if row.CachedValue else None
+                identifier["desired_value"] = jsonlib.loads(row.DesiredValue) if row.DesiredValue else None
+                identifier["revision"] = row.Revision
+
+        return store

{dissect_target-3.25.dev24 → dissect_target-3.25.dev26}/dissect/target/plugins/os/unix/linux/debian/proxmox/_os.py

@@ -18,6 +18,8 @@ from dissect.target.plugins.os.unix._os import OperatingSystem, export
 from dissect.target.plugins.os.unix.linux.debian._os import DebianPlugin
 
 if TYPE_CHECKING:
+    from pathlib import Path
+
     from typing_extensions import Self
 
     from dissect.target.target import Target
@@ -37,8 +39,7 @@ class ProxmoxPlugin(DebianPlugin):
         obj = super().create(target, sysvol)
 
         if (config_db := target.fs.path("/var/lib/pve-cluster/config.db")).exists():
-            with config_db.open("rb") as fh:
-                vfs = _create_pmxcfs(fh, obj.hostname)
+            vfs = _create_pmxcfs(config_db, obj.hostname)
 
             target.fs.mount("/etc/pve", vfs)
 
@@ -63,41 +64,40 @@ DT_DIR = 4
 DT_REG = 8
 
 
-def _create_pmxcfs(fh: BinaryIO, hostname: str | None = None) -> VirtualFilesystem:
+def _create_pmxcfs(fh: Path, hostname: str | None = None) -> VirtualFilesystem:
     # https://pve.proxmox.com/wiki/Proxmox_Cluster_File_System_(pmxcfs)
-    db = SQLite3(fh)
-
-    entries = {row.inode: row for row in db.table("tree")}
-
-    vfs = VirtualFilesystem()
-    for entry in entries.values():
-        if entry.type == DT_DIR:
-            cls = ProxmoxConfigDirectoryEntry
-        elif entry.type == DT_REG:
-            cls = ProxmoxConfigFileEntry
-        else:
-            raise ValueError(f"Unknown pmxcfs file type: {entry.type}")
-
-        parts = []
-        current = entry
-        while current.parent != 0:
+    with SQLite3(fh) as db:
+        entries = {row.inode: row for row in db.table("tree")}
+
+        vfs = VirtualFilesystem()
+        for entry in entries.values():
+            if entry.type == DT_DIR:
+                cls = ProxmoxConfigDirectoryEntry
+            elif entry.type == DT_REG:
+                cls = ProxmoxConfigFileEntry
+            else:
+                raise ValueError(f"Unknown pmxcfs file type: {entry.type}")
+
+            parts = []
+            current = entry
+            while current.parent != 0:
+                parts.append(current.name)
+                current = entries[current.parent]
             parts.append(current.name)
-            current = entries[current.parent]
-        parts.append(current.name)
 
-        path = "/".join(parts[::-1])
-        vfs.map_file_entry(path, cls(vfs, path, entry))
+            path = "/".join(parts[::-1])
+            vfs.map_file_entry(path, cls(vfs, path, entry))
 
-    if hostname:
-        node_root = vfs.path(f"nodes/{hostname}")
-        vfs.symlink(str(node_root), "local")
-        vfs.symlink(str(node_root / "lxc"), "lxc")
-        vfs.symlink(str(node_root / "openvz"), "openvz")
-        vfs.symlink(str(node_root / "qemu-server"), "qemu-server")
+        if hostname:
+            node_root = vfs.path(f"nodes/{hostname}")
+            vfs.symlink(str(node_root), "local")
+            vfs.symlink(str(node_root / "lxc"), "lxc")
+            vfs.symlink(str(node_root / "openvz"), "openvz")
+            vfs.symlink(str(node_root / "qemu-server"), "qemu-server")
 
-    # TODO: .version, .members, .vmlist, maybe .clusterlog and .rrd?
+        # TODO: .version, .members, .vmlist, maybe .clusterlog and .rrd?
 
-    return vfs
+        return vfs
 
 
 class ProxmoxConfigFileEntry(VirtualFile):

{dissect_target-3.25.dev24 → dissect_target-3.25.dev26}/dissect/target/plugins/os/windows/activitiescache.py

@@ -120,41 +120,39 @@ class ActivitiesCachePlugin(Plugin):
             clipboard_payload (string): ClipboardPayload field.
         """
         for user, cache_file in self.cachefiles:
-            fh = cache_file.open()
-            db = SQLite3(fh)
-
-            if table := db.table("Activity"):
-                for r in table.rows():
-                    yield ActivitiesCacheRecord(
-                        start_time=mkts(r["[StartTime]"]),
-                        end_time=mkts(r["[EndTime]"]),
-                        last_modified_time=mkts(r["[LastModifiedTime]"]),
-                        last_modified_on_client=mkts(r["[LastModifiedOnClient]"]),
-                        original_last_modified_on_client=mkts(r["[OriginalLastModifiedOnClient]"]),
-                        expiration_time=mkts(r["[ExpirationTime]"]),
-                        activity_id=r["[Id]"].hex(),
-                        app_id=r["[AppId]"],
-                        enterprise_id=r["[EnterpriseId]"] or None,
-                        app_activity_id=r["[AppActivityId]"],
-                        group_app_activity_id=r["[GroupAppActivityId]"] or None,
-                        group=r["[Group]"],
-                        activity_type=r["[ActivityType]"],
-                        activity_status=r["[ActivityStatus]"],
-                        activity_priority=r["[Priority]"],
-                        match_id=r["[MatchId]"],
-                        etag=r["[ETag]"],
-                        tag=r["[Tag]"],
-                        is_local_only=r["[IsLocalOnly]"],
-                        created_in_cloud=r["[CreatedInCloud]"],
-                        platform_device_id=r["[PlatformDeviceId]"],
-                        package_id_hash=r["[PackageIdHash]"],
-                        payload=r["[Payload]"],
-                        original_payload=r["[OriginalPayload]"],
-                        clipboard_payload=r["[ClipboardPayload]"],
-                        source=cache_file,
-                        _target=self.target,
-                        _user=user,
-                    )
+            with SQLite3(cache_file) as db:
+                if table := db.table("Activity"):
+                    for r in table.rows():
+                        yield ActivitiesCacheRecord(
+                            start_time=mkts(r["[StartTime]"]),
+                            end_time=mkts(r["[EndTime]"]),
+                            last_modified_time=mkts(r["[LastModifiedTime]"]),
+                            last_modified_on_client=mkts(r["[LastModifiedOnClient]"]),
+                            original_last_modified_on_client=mkts(r["[OriginalLastModifiedOnClient]"]),
+                            expiration_time=mkts(r["[ExpirationTime]"]),
+                            activity_id=r["[Id]"].hex(),
+                            app_id=r["[AppId]"],
+                            enterprise_id=r["[EnterpriseId]"] or None,
+                            app_activity_id=r["[AppActivityId]"],
+                            group_app_activity_id=r["[GroupAppActivityId]"] or None,
+                            group=r["[Group]"],
+                            activity_type=r["[ActivityType]"],
+                            activity_status=r["[ActivityStatus]"],
+                            activity_priority=r["[Priority]"],
+                            match_id=r["[MatchId]"],
+                            etag=r["[ETag]"],
+                            tag=r["[Tag]"],
+                            is_local_only=r["[IsLocalOnly]"],
+                            created_in_cloud=r["[CreatedInCloud]"],
+                            platform_device_id=r["[PlatformDeviceId]"],
+                            package_id_hash=r["[PackageIdHash]"],
+                            payload=r["[Payload]"],
+                            original_payload=r["[OriginalPayload]"],
+                            clipboard_payload=r["[ClipboardPayload]"],
+                            source=cache_file,
+                            _target=self.target,
+                            _user=user,
+                        )
 
 
 def mkts(ts: int) -> datetime | None:

{dissect_target-3.25.dev24 → dissect_target-3.25.dev26}/dissect/target/plugins/os/windows/cam.py

@@ -159,7 +159,7 @@ class CamPlugin(Plugin):
             )
 
     def _open_db(self) -> SQLite3 | None:
-        return SQLite3(self.camdb_path.open("rb")) if self.camdb_path else None
+        return SQLite3(self.camdb_path) if self.camdb_path else None
 
     def _build_context_dict(self) -> defaultdict[str, dict] | None:
         MAPDB = defaultdict(dict)

{dissect_target-3.25.dev24 → dissect_target-3.25.dev26}/dissect/target/plugins/os/windows/cim.py

@@ -106,7 +106,6 @@ class CimPlugin(Plugin):
         super().__init__(target)
         self._repo = None
         repodir = self.target.resolve("%windir%/system32/wbem/repository")
-        self._subscription_ns = None
         self._filters: dict[str, EventFilter] = {}
         if repodir.exists():
             index = repodir.joinpath("index.btr")
@@ -119,7 +118,6 @@ class CimPlugin(Plugin):
                 except cim.Error as e:
                     self.target.log.warning("Error opening CIM database")
                     self.target.log.debug("", exc_info=e)
-            self._subscription_ns = self._repo.root.namespace("subscription")
             self._filters = self._get_filters()
 
     def check_compatible(self) -> None:
@@ -131,13 +129,14 @@ class CimPlugin(Plugin):
         return self._repo
 
     def _iter_consumerbindings(self) -> Iterator[tuple[cim.Instance, str]]:
-        """Yield consumer bindings from ``__filtertoconsumerbinding`` of subscription namespace."""
+        """Yield consumer bindings from ``__filtertoconsumerbinding`` of all namespaces."""
         try:
-            for binding in self._subscription_ns.class_("__filtertoconsumerbinding").instances:
-                yield (
-                    self._subscription_ns.query(binding.properties["Consumer"].value),
-                    get_filter_name(binding),
-                )
+            for ns in self._repo.root.namespaces:
+                for binding in ns.class_("__filtertoconsumerbinding").instances:
+                    yield (
+                        ns.query(binding.properties["Consumer"].value),
+                        get_filter_name(binding),
+                    )
         except Exception as e:
             self.target.log.warning("Error retrieving consumerbindings")
             self.target.log.debug("", exc_info=e)
@@ -183,12 +182,13 @@ class CimPlugin(Plugin):
     def _get_filters(self) -> dict[str, EventFilter]:
         """Generate a dictionary of ``__EventFilter`` that can be mapped with ``__filtertoconsumerbinding``."""
         filters = {}
-        for event in self._subscription_ns.class_("__EventFilter").instances:
-            filter_name = event.properties["Name"].value
-            filters[filter_name] = EventFilter(
-                filter_name=filter_name,
-                filter_query=event.properties["Query"].value,
-                filter_query_language=event.properties["QueryLanguage"].value,
-                filter_creator_sid=get_creator_sid(event),
-            )
+        for ns in self._repo.root.namespaces:
+            for event in ns.class_("__EventFilter").instances:
+                filter_name = event.properties["Name"].value
+                filters[filter_name] = EventFilter(
+                    filter_name=filter_name,
+                    filter_query=event.properties["Query"].value,
+                    filter_query_language=event.properties["QueryLanguage"].value,
+                    filter_creator_sid=get_creator_sid(event),
+                )
         return filters

{dissect_target-3.25.dev24 → dissect_target-3.25.dev26}/dissect/target/plugins/os/windows/notifications.py

@@ -444,50 +444,50 @@ class NotificationsPlugin(Plugin):
         target_tz = self.target.datetime.tzinfo
 
         for user, wpndatabase in self.wpndb_files:
-            db = SQLite3(wpndatabase.open())
-            handlers = {}
-
-            if table := db.table("NotificationHandler"):
-                for row in table.rows():
-                    handlers[row["[RecordId]"]] = WpnDatabaseNotificationHandlerRecord(
-                        created_time=datetime.datetime.strptime(row["[CreatedTime]"], "%Y-%m-%d %H:%M:%S").replace(
-                            tzinfo=target_tz
-                        ),
-                        modified_time=datetime.datetime.strptime(row["[ModifiedTime]"], "%Y-%m-%d %H:%M:%S").replace(
-                            tzinfo=target_tz
-                        ),
-                        id=row["[RecordId]"],
-                        primary_id=row["[PrimaryId]"],
-                        wns_id=row["[WNSId]"],
-                        handler_type=row["[HandlerType]"],
-                        wnf_event_name=row["[WNFEventName]"],
-                        system_data_property_set=row["[SystemDataPropertySet]"],
-                        _target=self.target,
-                        _user=user,
-                    )
-
-            if table := db.table("Notification"):
-                for row in table.rows():
-                    record = WpnDatabaseNotificationRecord(
-                        arrival_time=wintimestamp(row["[ArrivalTime]"]),
-                        expiry_time=wintimestamp(row["[ExpiryTime]"]),
-                        order=row["[Order]"],
-                        id=row["[Id]"],
-                        handler_id=row["[HandlerId]"],
-                        activity_id=UUID(bytes=row["[ActivityId]"]),
-                        type=row["[Type]"],
-                        payload_data=row["[Payload]"],
-                        payload_type=row["[PayloadType]"],
-                        tag=row["[Tag]"],
-                        group=row["[Group]"],
-                        boot_id=row["[BootId]"],
-                        expires_on_reboot=row["[ExpiresOnReboot]"] != "FALSE",
-                        _target=self.target,
-                        _user=user,
-                    )
-                    handler = handlers.get(row["[HandlerId]"])
-
-                    if handler:
-                        yield GroupedRecord("windows/notification/wpndatabase/grouped", [record, handler])
-                    else:
-                        yield record
+            with SQLite3(wpndatabase) as db:
+                handlers = {}
+
+                if table := db.table("NotificationHandler"):
+                    for row in table.rows():
+                        handlers[row["[RecordId]"]] = WpnDatabaseNotificationHandlerRecord(
+                            created_time=datetime.datetime.strptime(row["[CreatedTime]"], "%Y-%m-%d %H:%M:%S").replace(
+                                tzinfo=target_tz
+                            ),
+                            modified_time=datetime.datetime.strptime(
+                                row["[ModifiedTime]"], "%Y-%m-%d %H:%M:%S"
+                            ).replace(tzinfo=target_tz),
+                            id=row["[RecordId]"],
+                            primary_id=row["[PrimaryId]"],
+                            wns_id=row["[WNSId]"],
+                            handler_type=row["[HandlerType]"],
+                            wnf_event_name=row["[WNFEventName]"],
+                            system_data_property_set=row["[SystemDataPropertySet]"],
+                            _target=self.target,
+                            _user=user,
+                        )
+
+                if table := db.table("Notification"):
+                    for row in table.rows():
+                        record = WpnDatabaseNotificationRecord(
+                            arrival_time=wintimestamp(row["[ArrivalTime]"]),
+                            expiry_time=wintimestamp(row["[ExpiryTime]"]),
+                            order=row["[Order]"],
+                            id=row["[Id]"],
+                            handler_id=row["[HandlerId]"],
+                            activity_id=UUID(bytes=row["[ActivityId]"]),
+                            type=row["[Type]"],
+                            payload_data=row["[Payload]"],
+                            payload_type=row["[PayloadType]"],
+                            tag=row["[Tag]"],
+                            group=row["[Group]"],
+                            boot_id=row["[BootId]"],
+                            expires_on_reboot=row["[ExpiresOnReboot]"] != "FALSE",
+                            _target=self.target,
+                            _user=user,
+                        )
+                        handler = handlers.get(row["[HandlerId]"])
+
+                        if handler:
+                            yield GroupedRecord("windows/notification/wpndatabase/grouped", [record, handler])
+                        else:
+                            yield record

{dissect_target-3.25.dev24 → dissect_target-3.25.dev26}/dissect/target/plugins/os/windows/search.py

@@ -166,9 +166,7 @@ class SearchIndexPlugin(Plugin):
     def parse_sqlite(self, path: Path, user_details: UserDetails | None) -> Iterator[SearchIndexRecords]:
         """Parse the SQLite3 ``SystemIndex_1_PropertyStore`` table."""
 
-        with path.open("rb") as fh:
-            db = SQLite3(fh)
-
+        with SQLite3(path) as db:
             # ``ColumnId`` is translated using the ``SystemIndex_1_PropertyStore_Metadata`` table.
             columns = {
                 row.get("Id"): row.get("UniqueKey", "").split("-", maxsplit=1)[-1]

{dissect_target-3.25.dev24 → dissect_target-3.25.dev26}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.25.dev24
+Version: 3.25.dev26
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later
@@ -23,7 +23,7 @@ License-File: LICENSE
 License-File: COPYRIGHT
 Requires-Dist: defusedxml
 Requires-Dist: dissect.cstruct<5,>=4
-Requires-Dist: dissect.database<2,>=1
+Requires-Dist: dissect.database<2,>=1.1.dev3
 Requires-Dist: dissect.eventlog<4,>=3
 Requires-Dist: dissect.evidence<4,>=3.13.dev2
 Requires-Dist: dissect.hypervisor<4,>=3.20
@@ -70,7 +70,7 @@ Requires-Dist: dissect.cim[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.clfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
 Requires-Dist: dissect.cramfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
 Requires-Dist: dissect.cstruct<5.0.dev,>=4.0.dev; extra == "dev"
-Requires-Dist: dissect.database[dev]<2.0.dev,>=1.0.dev; extra == "dev"
+Requires-Dist: dissect.database[dev]<2.0.dev,>=1.1.dev3; extra == "dev"
 Requires-Dist: dissect.etl[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.eventlog[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.evidence[dev]<4.0.dev,>=3.13.dev2; extra == "dev"