Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 6 additions & 8 deletions .gitmodules
Original file line number Diff line number Diff line change
Expand Up @@ -6,10 +6,6 @@
branch = main
path = submodules/dissect.cstruct
url = https://github.com/fox-it/dissect.cstruct.git
[submodule "submodules/dissect.esedb"]
branch = main
path = submodules/dissect.esedb
url = https://github.com/fox-it/dissect.esedb.git
[submodule "submodules/dissect.etl"]
branch = main
path = submodules/dissect.etl
Expand Down Expand Up @@ -46,10 +42,6 @@
branch = main
path = submodules/dissect.regf
url = https://github.com/fox-it/dissect.regf.git
[submodule "submodules/dissect.sql"]
branch = main
path = submodules/dissect.sql
url = https://github.com/fox-it/dissect.sql.git
[submodule "submodules/dissect.target"]
branch = main
path = submodules/dissect.target
Expand Down Expand Up @@ -125,3 +117,9 @@
[submodule "submodules/dissect.cramfs"]
path = submodules/dissect.cramfs
url = https://github.com/fox-it/dissect.cramfs.git
[submodule "submodules/dissect.database"]
path = submodules/dissect.database
url = https://github.com/fox-it/dissect.database.git
[submodule "submodules/dissect.apfs"]
path = submodules/dissect.apfs
url = https://github.com/fox-it/dissect.apfs.git
2 changes: 1 addition & 1 deletion .readthedocs.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ version: 2
build:
os: ubuntu-22.04
tools:
python: "3.9"
python: "3.10"
apt_packages:
- git
- libfuse2
Expand Down
43 changes: 43 additions & 0 deletions docs/source/projects/dissect.apfs/index.rst
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
dissect.apfs
============

.. button-link:: https://github.com/fox-it/dissect.apfs
:color: primary
:outline:

:octicon:`mark-github` View on GitHub

A Dissect module implementing parsers for the APFS file system, a commonly used Apple file system.

Installation
------------

``dissect.apfs`` is available on `PyPI <https://pypi.org/project/dissect.apfs/>`_.

.. code-block:: console

$ pip install dissect.apfs

This module is also automatically installed if you install the ``dissect`` package.

Usage
-----

This package is a library with no CLI tool, so you can only interact with it from Python.
For example, to print a directory listing of the root directory and read a file:

.. code-block:: python

from dissect.apfs import APFS

with open("path/to/apfs/file", "rb") as fh:
apfs = APFS(fh)

volume = apfs.volume[0]
print(volume.get("/").listdir())


Reference
---------

For more details, please refer to the API documentation of :mod:`dissect.apfs`.
62 changes: 62 additions & 0 deletions docs/source/projects/dissect.database/index.rst
Original file line number Diff line number Diff line change
@@ -0,0 +1,62 @@
dissect.database
================

.. button-link:: https://github.com/fox-it/dissect.database
:color: primary
:outline:

:octicon:`mark-github` View on GitHub

A Dissect module implementing parsers for various database formats, including:

- Berkeley DB, used for older RPM databases
- Microsoft Extensible Storage Engine (ESE), used for example in Active Directory, Exchange and Windows Update
- SQLite3, commonly used by applications to store configuration data

Installation
------------

``dissect.database`` is available on `PyPI <https://pypi.org/project/dissect.database/>`_.

.. code-block:: console

$ pip install dissect.database

This module is also automatically installed if you install the ``dissect`` package.

Usage
-----

This package is a library with no CLI tools, so you can only interact with it from Python.
For example, to print all records of all tables of an SQLite database:

.. code-block:: python

from dissect.database.sqlite3 import SQLite3

with open("/path/to/file.db", "rb") as fh:
db = SQLite3(fh)

for table in db.tables():
for row in table.rows():
print(row)

Or to print all records of all tables of an ESE database:

.. code-block:: python

from dissect.database.ese import ESE

with open("/path/to/ese.db", "rb") as fh:
db = ESE(fh)

for table in db.tables():
for record in table.get_records():
print(record)


Reference
---------

For more details, please refer to the API documentation of :mod:`dissect.database`.

44 changes: 0 additions & 44 deletions docs/source/projects/dissect.esedb/index.rst

This file was deleted.

45 changes: 0 additions & 45 deletions docs/source/projects/dissect.sql/index.rst

This file was deleted.

2 changes: 1 addition & 1 deletion docs/source/tools/target-dump.rst
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ Usage
-----

.. sphinx_argparse_cli::
:module: dissect.target.tools.dump.run
:module: dissect.target.tools.dump
:func: main
:prog: target-dump
:hook:
1 change: 1 addition & 0 deletions submodules/dissect.apfs
Submodule dissect.apfs added at 0a1a52
2 changes: 1 addition & 1 deletion submodules/dissect.archive
2 changes: 1 addition & 1 deletion submodules/dissect.btrfs
2 changes: 1 addition & 1 deletion submodules/dissect.cim
2 changes: 1 addition & 1 deletion submodules/dissect.clfs
Submodule dissect.clfs updated 2 files
+25 −8 pyproject.toml
+8 −10 tox.ini
2 changes: 1 addition & 1 deletion submodules/dissect.cramfs
1 change: 1 addition & 0 deletions submodules/dissect.database
Submodule dissect.database added at 14741f
1 change: 0 additions & 1 deletion submodules/dissect.esedb
Submodule dissect.esedb deleted from d7ed55
2 changes: 1 addition & 1 deletion submodules/dissect.etl
Submodule dissect.etl updated 2 files
+25 −8 pyproject.toml
+8 −10 tox.ini
2 changes: 1 addition & 1 deletion submodules/dissect.eventlog
Submodule dissect.eventlog updated 2 files
+25 −7 pyproject.toml
+6 −11 tox.ini
2 changes: 1 addition & 1 deletion submodules/dissect.extfs
2 changes: 1 addition & 1 deletion submodules/dissect.fat
Submodule dissect.fat updated 2 files
+25 −8 pyproject.toml
+8 −10 tox.ini
2 changes: 1 addition & 1 deletion submodules/dissect.ffs
Submodule dissect.ffs updated 2 files
+25 −8 pyproject.toml
+8 −10 tox.ini
2 changes: 1 addition & 1 deletion submodules/dissect.fve
Submodule dissect.fve updated 43 files
+4 −1 .github/workflows/dissect-ci.yml
+3 −0 .gitignore
+1 −1 MANIFEST.in
+1 −1 dissect/fve/__init__.py
+17 −0 dissect/fve/_build.py
+320 −0 dissect/fve/_native.src/Cargo.lock
+12 −0 dissect/fve/_native.src/Cargo.toml
+9 −0 dissect/fve/_native.src/src/crypto.rs
+53 −0 dissect/fve/_native.src/src/crypto/argon2.rs
+9 −0 dissect/fve/_native.src/src/lib.rs
+3 −0 dissect/fve/_native/__init__.pyi
+3 −0 dissect/fve/_native/crypto/__init__.pyi
+3 −0 dissect/fve/_native/crypto/argon2.pyi
+14 −9 dissect/fve/bde/bde.py
+1 −1 dissect/fve/bde/eow.py
+1 −1 dissect/fve/bde/information.py
+0 −0 dissect/fve/bde/key.py
+6 −2 dissect/fve/crypto/_pycryptodome.py
+36 −0 dissect/fve/crypto/argon2.py
+51 −0 dissect/fve/crypto/dmcrypt.py
+0 −0 dissect/fve/crypto/util.py
+0 −0 dissect/fve/exception.py
+1 −2 dissect/fve/luks/__init__.py
+2 −1 dissect/fve/luks/af.py
+9 −64 dissect/fve/luks/luks.py
+3 −21 dissect/fve/luks/metadata.py
+1 −1 dissect/fve/tools/dd.py
+33 −4 pyproject.toml
+0 −0 tests/_util.py
+0 −0 tests/bde/__init__.py
+40 −0 tests/bde/conftest.py
+22 −1 tests/bde/test_bde.py
+0 −0 tests/bde/test_eow.py
+6 −34 tests/conftest.py
+0 −0 tests/crypto/__init__.py
+1 −27 tests/crypto/test_crypto.py
+31 −0 tests/crypto/test_elephant.py
+0 −0 tests/luks/__init__.py
+142 −0 tests/luks/test_luks.py
+0 −0 tests/luks/test_metadata.py
+0 −44 tests/test_luks.py
+0 −69 tests/test_luks_kdf.py
+34 −9 tox.ini
2 changes: 1 addition & 1 deletion submodules/dissect.ole
Submodule dissect.ole updated 2 files
+25 −8 pyproject.toml
+8 −10 tox.ini
2 changes: 1 addition & 1 deletion submodules/dissect.qnxfs
2 changes: 1 addition & 1 deletion submodules/dissect.regf
2 changes: 1 addition & 1 deletion submodules/dissect.shellitem
Submodule dissect.shellitem updated 2 files
+25 −8 pyproject.toml
+8 −10 tox.ini
1 change: 0 additions & 1 deletion submodules/dissect.sql
Submodule dissect.sql deleted from 86d14f
2 changes: 1 addition & 1 deletion submodules/dissect.squashfs
2 changes: 1 addition & 1 deletion submodules/dissect.target
Submodule dissect.target updated 265 files
2 changes: 1 addition & 1 deletion submodules/dissect.thumbcache
Submodule dissect.thumbcache updated 2 files
+25 −8 pyproject.toml
+8 −10 tox.ini
2 changes: 1 addition & 1 deletion submodules/dissect.util
Submodule dissect.util updated 44 files
+13 −2 .devcontainer/devcontainer.json
+13 −15 dissect/util/_native.src/Cargo.lock
+1 −1 dissect/util/_native.src/Cargo.toml
+1 −1 dissect/util/_native.src/src/compression/lz4.rs
+9 −0 dissect/util/_native.src/src/hash.rs
+77 −0 dissect/util/_native.src/src/hash/crc32c.rs
+3 −1 dissect/util/_native.src/src/lib.rs
+2 −2 dissect/util/_native/__init__.pyi
+3 −0 dissect/util/_native/hash/__init__.py
+2 −0 dissect/util/_native/hash/crc32c.py
+3 −0 dissect/util/compression/__init__.py
+5 −2 dissect/util/compression/lz4.py
+130 −0 dissect/util/compression/lzbitmap.py
+467 −0 dissect/util/compression/lzfse.py
+5 −2 dissect/util/compression/lzo.py
+241 −0 dissect/util/compression/lzvn.py
+5 −2 dissect/util/compression/lzxpress.py
+7 −2 dissect/util/compression/lzxpress_huffman.py
+0 −76 dissect/util/feature.py
+28 −0 dissect/util/hash/__init__.py
+55 −0 dissect/util/hash/crc32.py
+237 −0 dissect/util/ldap.py
+2 −2 dissect/util/plist.py
+87 −62 dissect/util/stream.py
+1 −1 dissect/util/tools/dump_nskeyedarchiver.py
+2 −2 dissect/util/xmemoryview.py
+25 −4 pyproject.toml
+0 −0 tests/compression/__init__.py
+77 −0 tests/compression/test_lz4.py
+89 −0 tests/compression/test_lzbitmap.py
+75 −0 tests/compression/test_lzfse.py
+260 −0 tests/compression/test_lznt1.py
+237 −0 tests/compression/test_lzo.py
+81 −0 tests/compression/test_lzvn.py
+75 −0 tests/compression/test_lzxpress.py
+95 −0 tests/compression/test_lzxpress_huffman.py
+46 −0 tests/compression/test_sevenbit.py
+24 −0 tests/compression/test_xz.py
+16 −7 tests/conftest.py
+0 −336 tests/test_compression.py
+0 −37 tests/test_feature.py
+20 −14 tests/test_hash.py
+652 −0 tests/test_ldap.py
+19 −18 tox.ini
2 changes: 1 addition & 1 deletion submodules/flow.record
Submodule flow.record updated 64 files
+1 −0 .gitattributes
+2 −2 .gitignore
+0 −0 examples/__init__.py
+28 −29 examples/filesystem.py
+12 −9 examples/passivedns.py
+0 −0 examples/selectors.py
+5 −3 examples/tcpconn.py
+4 −1 flow/record/adapter/avro.py
+1 −0 flow/record/adapter/broker.py
+16 −6 flow/record/adapter/csvfile.py
+58 −19 flow/record/adapter/elastic.py
+7 −4 flow/record/adapter/jsonfile.py
+4 −1 flow/record/adapter/mongo.py
+3 −3 flow/record/adapter/splunk.py
+5 −2 flow/record/adapter/sqlite.py
+5 −2 flow/record/adapter/xlsx.py
+11 −5 flow/record/base.py
+69 −0 flow/record/context.py
+10 −0 flow/record/fieldtypes/__init__.py
+6 −18 flow/record/fieldtypes/net/ip.py
+3 −3 flow/record/fieldtypes/net/ipv4.py
+3 −2 flow/record/jsonpacker.py
+2 −2 flow/record/selector.py
+25 −8 flow/record/stream.py
+209 −46 flow/record/tools/rdump.py
+35 −1 flow/record/utils.py
+65 −20 pyproject.toml
+0 −0 tests/_data/.gitkeep
+0 −0 tests/_docs/Makefile
+0 −0 tests/_docs/conf.py
+0 −0 tests/_docs/index.rst
+0 −0 tests/adapter/__init__.py
+50 −1 tests/adapter/test_avro.py
+0 −0 tests/adapter/test_csv.py
+0 −0 tests/adapter/test_elastic.py
+1 −2 tests/adapter/test_json.py
+0 −0 tests/adapter/test_line.py
+7 −3 tests/adapter/test_splunk.py
+3 −2 tests/adapter/test_sqlite_duckdb.py
+0 −0 tests/adapter/test_text.py
+1 −2 tests/adapter/test_xlsx.py
+13 −0 tests/conftest.py
+0 −0 tests/fieldtypes/__init__.py
+15 −6 tests/fieldtypes/test_fieldtypes.py
+2 −2 tests/fieldtypes/test_ip.py
+0 −0 tests/packer/__init__.py
+27 −1 tests/packer/test_json_packer.py
+8 −6 tests/packer/test_packer.py
+0 −0 tests/record/__init__.py
+8 −9 tests/record/test_adapter.py
+66 −0 tests/record/test_context.py
+0 −0 tests/record/test_descriptor.py
+0 −0 tests/record/test_multi_timestamp.py
+27 −7 tests/record/test_record.py
+0 −0 tests/selector/__init__.py
+0 −0 tests/selector/test_compiled.py
+7 −3 tests/selector/test_selectors.py
+0 −19 tests/standalone_test.py
+0 −58 tests/test_avro_adapter.py
+79 −19 tests/test_regressions.py
+25 −0 tests/test_utils.py
+0 −0 tests/tools/__init__.py
+82 −7 tests/tools/test_rdump.py
+12 −14 tox.ini