Releases · fox-it/dissect

01 Jul 09:33

pyrco

3.15

2ac8c15

3.15 Latest

Latest

Highlights

Release of dissect.cstruct V.4.0 - major rewrite of dissect core engine! Further details
target tools usability:
- Improved error description
- Indication for cache use
- Configurations query plugin including the use of glob patterns in searches
MPLog parser added to Windows Defender plugin
Identification of Windows 11 build improved

Contributors

Thanks to our contributors for making this release possible:

@JSCU-CNI

Full Changelogs

Contributors

JSCU-CNI

Assets 2

08 May 12:56

narimantos

3.14

3da3d70

Release dissect 3.14

Highlights

New project created:

dissect.archive: Adds parsers for various archive and backup formats
- Support for WIM format (except for split files)

Notable changes:

Acquire:
- Better de-duplication of paths
- Consistent casing of drive letters in windows acquires
- You can now target multiple targets!
- Addtional AnyDesk paths collected
dissect.ntfs:
- Ability to yield MFT segments in specified ranges
dissect.target:
- Uses new flow.record v.3.15
- Added a layer filesystem that extends the root filesystem
- Support for TOML in Unix Config Parser
- target-dump supports namespace plugins
- Support for Fortinet FW files
- Catroot plugin refactored and improved
flow.record: Changes to the TCP Splunk adapter:
- type field renamed rdtype
- Additional internal record fields added:
  - rd__source from _source
  - rd__classification from _classification
  - rd_generated from _generated

Contributors

Thanks to our contributors for making this release possible:

@Bopobopob
@d3dave
@joost-j
@JSCU-CNI
@M1ra1B0T
@MaxGroot
@mnrkbys
@Zawadidone

Full Changelogs

Contributors

d3dave, joost-j, and 6 other contributors

Assets 2

08 Mar 08:58

pyrco

3.13

97ced28

Release dissect 3.13 (#48)

Highlights

New filesystem support

vmtar (archive based filesystem)
cpio (archive based filesystem)

New plugins

Brave browser plugin as apps.browser.brave
Docker logs plugin as apps.container.docker.logs
Linux locate plugin as os.unix.locate

Plugin improvements

The Firefox and Chromium-based browser plugins now support reporting cookie data
In absence of configuration files, the IIS plugin wil try to find logs in default directories
The Windows Error Report Plugin is made more robust against keys that clash with restricted record names
The Windows Defender plugin now properly sets the ts (timestamp) field

Misc changes

Windows installations on drive letters other than C:\ are now supported
On Linux systems mounts by label are now supported
The unified configuration parser now supports JSON, YAML and XML
Integrated test runs on Windows in the CI pipeline
Support TPM encrypted ESXi "local state" filesystem

Contributors

Thanks to our contributors for making this release possible:

@florisvanstal
@JSCU-CNI
@YoeriNijs
@Zawadidone

Full Changelogs

Contributors

YoeriNijs, Zawadidone, and 2 other contributors

Assets 2

26 Jan 13:45

pyrco

3.12

2109b5d

Release dissect 3.12 (#45)

Highlights

New platforms

The FortiOS platform is now supported as a Linux sub-OS

New filesystem support

jffs is now also available in dissect.target

Filesystem improvements

Sparse indirect blocks in ExtFS now work properly
Improved parsing of complex ACLs in NTFS

New plugins

A PuTTY plugin is added to the apps/ssh section
A Citrix Netscaler webserver logs plugin is added to the apps/webservers section
A SchedLgU plugin to parse SchedLgU.txt logs is added to the os/windows/log section

Misc changes

Speed improvements in reading esedb records
Virtual NTFS filesystems are now acquired properly
Acquired files from case insensitive filesystems are now correctly de-duplicated
Numerous miscellaneous Linux and Windows artifacts are added to acquire to be collected
TargetPath now supports Python 3.12 (and as a consequence so does the whole of dissect)
The Yara plugin is now supported by using our own pre-build yara-python-wheel pypi repository
target-shell now has more cyber
fuse3 support is added to target-mount

Contributors

Thanks to our contributors for making this release possible:

@burneykb
@diversenok
@JSCU-CNI
@MaxGroot
@Repsay
@JazzCore
@ydkhatri
@Zawadidone

Full Changelogs

Contributors

JazzCore, burneykb, and 6 other contributors

Assets 2

18 Dec 12:54

pyrco

3.11

2b5d9a6

Release dissect 3.11 (#41)

Highlights

New filesystem support

btrfs
jffs (not yet available in dissect.target)

Improved plugins

Unix acitivity robustness
Windows CIM (consumerbindings) database robustness
Windows MRUList robustness
Windows teamviewer robustness in datetime parsing
Windows iexplore.downloads robustness
sshd.config proper config parsing of multiple values for the same key
walkfs now walks the target's root filesystem instead of all the separate filesystems

Misc changes

Most unit tests should now also run on windows
Improved output for the --hash option of target-query
Previously detected but unmounted filesystems are now mounted under $fs$/fs<idx>
Improved support for Alpine Linux
target-shell deals better with unicode characters in path and file names

Contributors

Thanks to our contributors for making this release possible:

@JSCU-CNI
@Paradoxis
@Zawadidone

Full Changelogs

Contributors

Paradoxis, Zawadidone, and JSCU-CNI

Assets 2

08 Nov 14:50

pyrco

3.10

515c2e0

Release dissect 3.10 (#39)

Highlights

Misc Changes

target-info is made more robust against missing information in a target.
A unified configuration parser to parse configuration files is added. For now it parses:
- .ini files,
- files with key<separator>value entries,
- plain text files (like shell scripts as configuration),
- systemd type configuration files,
- ssh(d) type configuration files.
target-shell on unix type systems got a registry command, which will use the etc plugin which builds on top of the unified configuration parser.
target-query got a --dry-run option to show which functions (specified by -f) would have been executed on a target.
target-query got a -xf option to exclude functions sepcified by -f. This is useful to exclude certain functions when wildcards are used in the -f option.
The --hash option of target-query is fixed, as it was broken after last release.

New loaders

Open Virtual Appliance (OVA) files.

New volumes

LUKS v2 volumes are now supported.
DDF (Disk Data Format, the RAID disk format used by for Dell systems) volumes are now supported.

New Plugins

An etc plugin is added for unix type systems which uses the unified configuration parser.

Updated Plugins

The wireguard plugin is more robust against missing data in configuration files, which can happen on Windows systems.
The linux _os plugin now supports /dev/disk/by-uuid fstab entries.

Contributors

Thanks to our contributors for making this release possible:

@JSCU-CNI

Full Changelogs

Contributors

JSCU-CNI

Assets 2

26 Sep 15:19

pyrco

3.9

5411f06

Release dissect 3.9 (#38)

Highlights

Misc changes:

dissect.cstruct has a new and vastly improved expression parser
Support for various RAID formats and LVM variants
Volatile directories are now mounted when running on a local target
Add support for decrypting and using System DPAPI secrets on Windows

New loaders:

Add a new SMB loader and filesystem to use an SMB share as target

New plugins:

cPanel lastlogin files
Symantic Secure Endpoint
Windows 10 notifications from appdb.dat file
multiple plugins for volatile Linux artifacts (sockets, processes)
Linux modules and lsmod plugin

Updated plugins

IPv6 adresses in UTMP logs are now interpreted correctly
ufw firewall configuration support added to the Linux firewall plugin

Acquire changes:

Add collection of OSX DHCP settings and application's Info.plist paths
Improved collection of Linux volatile paths (/proc & /sys)
Add collection of paths related to Windows memoy
IIS artefacts are now collected by default in the "full" profile

Contributors

Thanks to our contributors for making this release possible:

@0x49736b
@cobyge
@idem-s1n
@JSCU-CNI
@OlafHaalstra
@Paradoxis
@RGlintmeijer
@sMezaOrellana
@Zawadidone

Full Changelogs

Contributors

OlafHaalstra, Paradoxis, and 7 other contributors

Assets 2

14 Aug 14:58

Miauwkeru

3.8.1

6320ef1

Release dissect 3.8.1

Highlights

Fixed issue in registry plugin where the root key could not be fetched, which impacted the regf plugin and target-regf.
Add a OSPlugin for citrix netscalers

Full Changelogs

Assets 2

10 Aug 12:52

Miauwkeru

3.8

c8483bc

Release dissect 3.8

Highlights

New plugins:

Generic:
- OpenVPN configuration plugin for client and server configuration
OSX:
- User plugin, which shows all the users on osx machines
- IPs plugin, allows the ips to work on osx targets

Updated plugins:

ETL: Now decompresses compressed buffers
Unix services: Improved the systemd service parsing

Loader:

DirLoader: functions with directories made using acquire
MultiRawLoader: Allows you to load multiple disks into one target.
This has to be a + separated string containing absolute or relative path to the disks. (/path/to/disk1+/path/to/disk2)

Misc changes/fixes:

Target-shell
- Use enter <path> to open a target inside of another target.
- No duplicate files when saving a directory using the save command.
Registry improvements: Allows for globbing through the windows registry

Contributors

Thanks to our contributors for making this release possible:

@cobyge
@nrhtr
@JSCU-CNI
@sMezaOrellana
@sulonl
@Zawadidone

Full Changelogs

Contributors

nrhtr, cobyge, and 4 other contributors

Assets 2

06 Jul 09:29

pyrco

3.7

b165378

Release dissect 3.7 (#33)

Highlights

Windows plugin additions and improvements:
- at.exe jobs are now emitted by the tasks plugin.
- Tasks from AD Group Policy Objects are now emitted by the tasks plugin.
  - Tasks within a ScheduledTask.xml file are not parsed when nested in a <ScheduledTask> element. This will be supported in the next release.
- A new AppX debug information plugin appxdebugkeys is added.
- The Windows defender plugin can now also emit exclusions.
- amcache now returns the proper arp created install records.
- A new shophos plugin supporting Sophos Home and Sophos Hitman has been added.
Linux plugin additions and improvements:
- A new systemd journal plugin is added.
Loader additions and improvements:
- The LogLoader can now handle IIS logs.
Misc improvements:
- Cleaner handling of KeyboardInterrups and OSErrors in the various target tools.
- Compatibility for TargetPath and FilesystemEntry with Python 3.11.4.
- The LZO decompressor now handles bitstream compressed data properly.
- target-info now handles time zones properly for older Windows versions.

Contributors

Thanks to our contributors for making this release possible:

@cobyge
@JSCU-CNI
@Zawadidone

Full Changelogs

Contributors

cobyge, Zawadidone, and JSCU-CNI

Assets 2

Releases: fox-it/dissect

3.15

Highlights

Contributors

Full Changelogs

Contributors

Release dissect 3.14

Highlights

Contributors

Full Changelogs

Contributors

Release dissect 3.13 (#48)

Highlights

New filesystem support

New plugins

Plugin improvements

Misc changes

Contributors

Full Changelogs

Contributors

Release dissect 3.12 (#45)

Highlights

New platforms

New filesystem support

Filesystem improvements

New plugins

Misc changes

Contributors

Full Changelogs

Contributors

Release dissect 3.11 (#41)

Highlights

New filesystem support

Improved plugins

Misc changes

Contributors

Full Changelogs

Contributors

Release dissect 3.10 (#39)

Highlights

Misc Changes

New loaders

New volumes

New Plugins

Updated Plugins

Contributors

Full Changelogs

Contributors

Release dissect 3.9 (#38)

Highlights

Misc changes:

New loaders:

New plugins:

Updated plugins

Acquire changes:

Contributors

Full Changelogs

Contributors

Release dissect 3.8.1

Highlights

Full Changelogs

Release dissect 3.8

Highlights

New plugins:

Updated plugins:

Loader:

Misc changes/fixes:

Contributors

Full Changelogs

Contributors

Release dissect 3.7 (#33)

Highlights

Contributors

Full Changelogs

Contributors