Package: dissect.target
dissect.targetThe Dissect module tying all other Dissect modules together. It provides a programming API and command line tools which
allow easy access to various data sources inside disk images or file collections (a.k.a. targets). For more information,
please seethe documentation.RequirementsThis project is part of the Dissect framework and requires Python.Information on the supported Python versions can be found in the Getting Started section ofthe documentation.Installationdissect.targetis available onPyPI.pipinstalldissect.targetThis module is also automatically installed if you install thedissectpackage.If you wish to use the YARA plugin (target-query -f yara), you can installdissect.target[yara]to automatically
install theyara-pythondependency.Tools inside this projecttarget-querytarget-queryis a tool used to query specific data inside one or more targets.
These queries are available in the form of functions that reside withinplugins.
Each plugin is focussed on providing specific functionality.This functionality can range from parsing log sources, such as command history logs (i.e. bash history,
PowerShell history, etc.), to returning the hostname and operating system version.The most basic basic usage oftarget-queryis to execute a function on a target:target-query-f<FUNCTION_NAME>/example_path/target.vmdkYou can also use basic path expansion to execute functions over multiple targets. For example, to execute a function
on all.vmdkfiles in a directory:target-query -f <FUNCTION_NAME> /example_path/*.vmdkNot every target plugin will function on every target, they are OS specific.
More information on how to usetarget-queryis found inthe documentation.target-shelltarget-shellgives you the ability to access a target using a virtual shell environment. Once a shell is opened
on a target, typehelpto list the available commands. To see the documentation of each command,
you can usehelp [COMMAND].Opening a shell on a target is straight-forward. You can do so by specifying a path to a target as follows:target-shelltargets/EXAMPLE.vmxEXAMPLE/>helpDocumentedcommands(typehelp<topic>):========================================catdisksfilesystemshelplesspythonsavecdexitfindhexdumplsreadlinkstatclearfilehashinfopwdregistryvolumesEXAMPLE/>lsc:sysvolFurther interacting with the target can be done using the commands listed above.
You can exit the shell by runningexitor by pressingCTRL+D.More information on how to usetarget-shellis found inthe documentation.target-fsWithtarget-fsyou can interact with the filesystem of a target using a set of familiar Unix commands.The basic structure of atarget-fscommand is as follows:target-fs<path_to_target><command><path_for_command>NOTE:As with any shell command, you have to properly escape backlashes and spaces. Unless you use single or double quotes (',").More information on how to usetarget-fsis found inthe documentation.target-regWithtarget-regyou can easily query the registry of Windows targets and print the results in a tree. A+symbol indicates that it is a registry key (i.e. may have subkeys). A-symbol indicates a registry value.user@dissect~$target-regtargets/EXAMPLE.E01-k"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft"+'Microsoft'(last-modified-date-shows-here)+'.NETFramework'(last-modified-date-shows-here)-'Enable64Bit'value-shows-here[...]More information on how to usetarget-regis found inthe documentation.target-dumpWithtarget-dumpyou can export records of a specificfunctionused in target-query to a file.The basic structure of atarget-dumpcommand is as follows:target-dump-f<comma_seperated_functions><path_to_target>Futhermore, the tool can apply certain compression algorithms to the dump, to create small archives of the output.More information on how to usetarget-dumpis found inthe documentation.target-ddWithtarget-ddyou can export (a part of) a target to a file or to stdout. At the moment,target-ddcan be used for targets that have only one disk.The basic structure of atarget-ddcommand is as follows:target-dd--write<output_file>--offset<offset_on_target_in_bytes>--bytes<nr_of_bytes_to_read><path_to_target>More information on how to usetarget-ddis found inthe documentation.target-mountWithtarget-mountyou can mount the filesystem of a target to any arbitrary directory on your analysis machine, similar to themountcommand on Unix systems.
To perform this function, we usefusepyto mount a filesystem in linux and mac.
This interacts withfuselibto mount disk images in linux userspace, so no administrative access is required.target-mounthas two required positional arguments:TARGET- Target to mountMOUNT- Directory to mount the target's filesystem onThe following example command can be used to mount a target to the directorymnt:user@dissect~$target-mounttargets/EXAMPLE.vmx~/mnt/EXAMPLE
user@dissect~$ls~/mnt/EXAMPLE/
disksfsvolumesWhen mounting a target usingtarget-mountthe process is kept in the foreground. This will occupy your current
terminal session. It is recommended to either open a second terminal, let this command run in the background by
appending&to the command or use a terminal multiplexer liketmuxto start a second session. Using one
of these methods enables you to interact with the mountpoint.More information on how to usetarget-mountis found inthe documentation.Build and test instructionsThis project usestoxto build source and wheel distributions. Run the following command from the root folder to build
these:tox-ebuildThe build artifacts can be found in thedist/directory.toxis also used to run linting and unit tests in a self-contained environment. To run both linting and unit tests
using the default installed Python version, run:toxFor a more elaborate explanation on how to build and test the project, please seethe
documentation.ContributingThe Dissect project encourages any contribution to the codebase. To make your contribution fit into the project, please
refer tothe development guide.Copyright and licenseDissect is released as open source by Fox-IT (https://www.fox-it.com) part of NCC Group Plc
(https://www.nccgroup.com).Developed by the Dissect Team (dissect@fox-it.com) and made available athttps://github.com/fox-it/dissect.License terms: AGPL3 (https://www.gnu.org/licenses/agpl-3.0.html). For more information, see the LICENSE file.