{"id":28486105,"url":"https://github.com/fox-it/dissect.target","last_synced_at":"2026-02-24T18:11:51.789Z","repository":{"id":61301891,"uuid":"515991829","full_name":"fox-it/dissect.target","owner":"fox-it","description":"The Dissect module tying all other Dissect modules together. It provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets).","archived":false,"fork":false,"pushed_at":"2025-06-25T12:26:44.000Z","size":11109,"stargazers_count":65,"open_issues_count":174,"forks_count":62,"subscribers_count":17,"default_branch":"main","last_synced_at":"2025-06-25T12:27:13.312Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/fox-it.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2022-07-20T13:24:12.000Z","updated_at":"2025-06-23T09:10:05.000Z","dependencies_parsed_at":"2025-04-25T10:31:04.678Z","dependency_job_id":"3488e626-3303-49ea-acbd-713668ef521d","html_url":"https://github.com/fox-it/dissect.target","commit_stats":{"total_commits":171,"total_committers":14,"mean_commits":"12.214285714285714","dds":0.7485380116959064,"last_synced_commit":"95fea421919d0eb403bf72de037cc39d55f2b12d"},"previous_names":[],"tags_count":25,"template":false,"template_full_name":null,"purl":"pkg:github/fox-it/dissect.target","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fox-it%2Fdissect.target","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fox-it%2Fdissect.target/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fox-it%2Fdissect.target/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fox-it%2Fdissect.target/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/fox-it","download_url":"https://codeload.github.com/fox-it/dissect.target/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fox-it%2Fdissect.target/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":263140396,"owners_count":23419873,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-06-08T01:10:16.022Z","updated_at":"2026-02-24T18:11:46.756Z","avatar_url":"https://github.com/fox-it.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# dissect.target\n\nThe Dissect module tying all other Dissect modules together. It provides a programming API and command line tools which\nallow easy access to various data sources inside disk images or file collections (a.k.a. targets). For more information,\nplease see [the documentation](https://docs.dissect.tools/en/latest/projects/dissect.target/index.html).\n\n## Requirements\n\nThis project is part of the Dissect framework and requires Python.\n\nInformation on the supported Python versions can be found in the Getting Started section of [the documentation](https://docs.dissect.tools/en/latest/index.html#getting-started).\n\n## Installation\n\n`dissect.target` is available on [PyPI](https://pypi.org/project/dissect.target/).\n\n```bash\npip install dissect.target\n```\n\nThis module is also automatically installed if you install the `dissect` package.\n\nIf you wish to use the YARA plugin (`target-query -f yara`), you can install `dissect.target[yara]` to automatically \ninstall the `yara-python` dependency.\n\n## Tools inside this project\n\n### target-query\n`target-query` is a tool used to query specific data inside one or more targets.\nThese queries are available in the form of functions that reside within [plugins](https://docs.dissect.tools/en/latest/advanced/plugins.html).\nEach plugin is focussed on providing specific functionality.\n\nThis functionality can range from parsing log sources, such as command history logs (i.e. bash history,\nPowerShell history, etc.), to returning the hostname and operating system version.\n\nThe most basic basic usage of `target-query` is to execute a function on a target:\n\n```bash\ntarget-query -f \u003cFUNCTION_NAME\u003e /example_path/target.vmdk\n```\n\nYou can also use basic path expansion to execute functions over multiple targets. For example, to execute a function\non all ``.vmdk`` files in a directory:\n\n```\ntarget-query -f \u003cFUNCTION_NAME\u003e /example_path/*.vmdk\n```\n\nNot every target plugin will function on every target, they are OS specific.\nMore information on how to use `target-query` is found in [the documentation](https://docs.dissect.tools/en/latest/tools/target-query.html).\n\n### target-shell\n`target-shell` gives you the ability to access a target using a virtual shell environment. Once a shell is opened\non a target, type `help` to list the available commands. To see the documentation of each command,\nyou can use `help [COMMAND]`.\n\nOpening a shell on a target is straight-forward. You can do so by specifying a path to a target as follows:\n\n```bash\n    target-shell targets/EXAMPLE.vmx\n    WIN-EXAMPLE:/$ help\n\n    Documented commands (type help \u003ctopic\u003e):\n    ========================================\n    attr   cls    enter        find     info  man       registry  volumes\n    cat    cyber  exit         hash     less  pwd       save      zcat   \n    cd     debug  file         help     ll    python    stat      zless  \n    clear  disks  filesystems  hexdump  ls    readlink  tree    \n\n    WIN-EXAMPLE:/$ ls\n    $fs$\n    c:\n    efi\n    sysvol\n```\n\nFurther interacting with the target can be done using the commands listed above.\nYou can exit the shell by running `exit` or by pressing `CTRL+D`.\n\nMore information on how to use `target-shell` is found in [the documentation](https://docs.dissect.tools/en/latest/tools/target-shell.html).\n\n### target-fs\nWith `target-fs` you can interact with the filesystem of a target using a set of familiar Unix commands.\n\nThe basic structure of a `target-fs` command is as follows:\n\n```bash\ntarget-fs \u003cpath_to_target\u003e \u003ccommand\u003e \u003cpath_for_command\u003e\n```\n\n**NOTE:** As with any shell command, you have to properly escape backlashes and spaces. Unless you use single or double quotes (`'`, `\"`).\n\nMore information on how to use `target-fs` is found in [the documentation](https://docs.dissect.tools/en/latest/tools/target-fs.html).\n\n### target-reg\nWith `target-reg` you can easily query the registry of Windows targets and print the results in a tree. A `+` symbol indicates that it is a registry key (i.e. may have subkeys). A `-` symbol indicates a registry value.\n\n```bash\nuser@dissect~$ target-reg targets/EXAMPLE.E01 -k \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\"\n+ 'Microsoft' (last-modified-date-shows-here)\n    + '.NETFramework' (last-modified-date-shows-here)\n    - 'Enable64Bit' value-shows-here\n[...]\n```\n\nMore information on how to use `target-reg` is found in [the documentation](https://docs.dissect.tools/en/latest/tools/target-reg.html).\n\n### target-dump\nWith `target-dump` you can export records of a specific `function` used in target-query to a file.\n\nThe basic structure of a `target-dump` command is as follows:\n\n```bash\ntarget-dump -f \u003ccomma_seperated_functions\u003e \u003cpath_to_target\u003e\n```\n\nFuthermore, the tool can apply certain compression algorithms to the dump, to create small archives of the output.\n\nMore information on how to use `target-dump` is found in [the documentation](https://docs.dissect.tools/en/latest/tools/target-dump.html).\n\n### target-dd\nWith `target-dd` you can export (a part of) a target to a file or to stdout. At the moment, `target-dd` can be used for targets that have only one disk.\n\nThe basic structure of a `target-dd` command is as follows:\n\n```bash\ntarget-dd --write \u003coutput_file\u003e --offset \u003coffset_on_target_in_bytes\u003e --bytes \u003cnr_of_bytes_to_read\u003e \u003cpath_to_target\u003e\n```\n\nMore information on how to use `target-dd` is found in [the documentation](https://docs.dissect.tools/en/latest/tools/target-dd.html).\n\n### target-mount\nWith `target-mount` you can mount the filesystem of a target to any arbitrary directory on your analysis machine, similar to the `mount` command on Unix systems.\nTo perform this function, we use `fusepy` to mount a filesystem in linux and mac.\nThis interacts with `fuselib` to mount disk images in linux userspace, so no administrative access is required.\n\n`target-mount` has two required positional arguments:\n\n* `TARGET` - Target to mount\n* `MOUNT` - Directory to mount the target's filesystem on\n\n\nThe following example command can be used to mount a target to the directory ``mnt``:\n\n```bash\nuser@dissect~$ target-mount targets/EXAMPLE.vmx ~/mnt/EXAMPLE\nuser@dissect~$ ls ~/mnt/EXAMPLE/\ndisks   fs   volumes\n```\n\nWhen mounting a target using `target-mount` the process is kept in the foreground. This will occupy your current\nterminal session. It is recommended to either open a second terminal, let this command run in the background by\nappending `\u0026` to the command or use a terminal multiplexer like `tmux` to start a second session. Using one\nof these methods enables you to interact with the mountpoint.\n\nMore information on how to use `target-mount` is found in [the documentation](https://docs.dissect.tools/en/latest/tools/target-mount.html).\n\n## Build and test instructions\n\nThis project uses `tox` to build source and wheel distributions. Run the following command from the root folder to build\nthese:\n\n```bash\ntox -e build\n```\n\nThe build artifacts can be found in the `dist/` directory.\n\n`tox` is also used to run linting and unit tests in a self-contained environment. To run both linting and unit tests\nusing the default installed Python version, run:\n\n```bash\ntox\n```\n\nFor a more elaborate explanation on how to build and test the project, please see [the\ndocumentation](https://docs.dissect.tools/en/latest/contributing/tooling.html).\n\n## Contributing\n\nThe Dissect project encourages any contribution to the codebase. To make your contribution fit into the project, please\nrefer to [the development guide](https://docs.dissect.tools/en/latest/contributing/developing.html).\n\n## Copyright and license\n\nDissect is released as open source by Fox-IT (\u003chttps://www.fox-it.com\u003e) part of NCC Group Plc\n(\u003chttps://www.nccgroup.com\u003e).\n\nDeveloped by the Dissect Team (\u003cdissect@fox-it.com\u003e) and made available at \u003chttps://github.com/fox-it/dissect\u003e.\n\nLicense terms: AGPL3 (\u003chttps://www.gnu.org/licenses/agpl-3.0.html\u003e). For more information, see the LICENSE file.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffox-it%2Fdissect.target","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffox-it%2Fdissect.target","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffox-it%2Fdissect.target/lists"}