Package: dissect
dissectDissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).This project is a meta package, it will install all other Dissect modules with the right combination of versions. For
more information, please seethe documentation.What is Dissect?Dissect is an incident response framework build from various parsers and implementations of file formats. Tying this all together, Dissect allows you to work with tools namedtarget-queryandtarget-shellto quickly gain access to forensic artefacts, such as Runkeys, Prefetch files, and Windows Event Logs, just to name a few!Singular approachAnd the best thing: all in a singular way, regardless of underlying container (E01, VMDK, QCoW), filesystem (NTFS, ExtFS, FFS), or Operating System (Windows, Linux, ESXi) structure / combination. You no longer have to bother extracting files from your forensic container, mount them (in case of VMDKs and such), retrieve the MFT, and parse it using a separate tool, to finally create a timeline to analyse. This is all handled under the hood by Dissect in a user-friendly manner.If we take the example above, you can start analysing parsed MFT entries by just using a command liketarget-query -f mft <PATH_TO_YOUR_IMAGE>!Create a lightweight container using AcquireDissect also provides you with a tool calledacquire. You can deploy this tool on endpoint(s) to create a lightweight container of these machine(s). What is convenient as well, is that you can deployacquireon a hypervisor to quickly create lightweight containers of all the (running) virtual machines on there! All without having to worry about file-locks. These lightweight containers can then be analysed using the tools liketarget-queryandtarget-shell, but feel free to use other tools as well.A modular setupDissect is made with a modular approach in mind. This means that each individual project can be used on its own (or in combination) to create a completely new tool for your engagement or future use!Try it out now!Interested in trying it out for yourself? You can simplypip install dissectand start using thetarget-*tooling right away. Or you can use the interactive playground athttps://try.dissect.toolsto try Dissect in your browser.Don’t know where to start? Check out theintroduction page.Want to get a detailed overview? Check out theoverview page.Want to read everything? Check out thedocumentation.ProjectsDissect currently consists of the following projects.dissect.btrfsdissect.cimdissect.clfsdissect.cstructdissect.esedbdissect.etldissect.eventlogdissect.evidencedissect.executabledissect.extfsdissect.fatdissect.ffsdissect.hypervisordissect.jffsdissect.ntfsdissect.oledissect.regfdissect.sqldissect.squashfsdissect.targetdissect.thumbcachedissect.utildissect.vmfsdissect.volumedissect.xfsRelatedThese projects are closely related to Dissect, but not installed by this meta package.acquireflow.recordRequirementsThis project is part of the Dissect framework and requires Python.Information on the supported Python versions can be found in the Getting Started section ofthe documentation.Installationdissectis available onPyPI.pipinstalldissectBuild and test instructionsThis project usestoxto build source and wheel distributions. Run the following command from the root folder to build
these:tox-ebuildThe build artifacts can be found in thedist/directory.toxis also used to run linting and unit tests in a self-contained environment. To run both linting and unit tests
using the default installed Python version, run:toxFor a more elaborate explanation on how to build and test the project, please seethe
documentation.ContributingThe Dissect project encourages any contribution to the codebase. To make your contribution fit into the project, please
refer tothe development guide.Copyright and licenseDissect is released as open source by Fox-IT (https://www.fox-it.com) part of NCC Group Plc
(https://www.nccgroup.com).Developed by the Dissect Team (dissect@fox-it.com) and made available athttps://github.com/fox-it/dissect.License terms: AGPL3 (https://www.gnu.org/licenses/agpl-3.0.html). For more information, see the LICENSE file.