dissect.target is a core Python module that ties together various Dissect components, offering a programming API and command-line tools for accessing data sources within disk images or file collections (referred to as 'targets'). It is currently at version 3.25.1 and is actively maintained, with regular releases reflecting ongoing development in digital forensics and incident response tooling.
pip install dissect.targetVerified import paths — ran on the pinned version, not inferred.
This quickstart demonstrates how to open a target (e.g., a disk image or directory) and extract basic information such as hostname, OS version, and user accounts. It uses `Target.open()` to transparently handle various forensic image formats and then accesses attributes and methods on the `Target` object. Ensure you replace the placeholder path with an actual forensic artifact.
Explicitly open individual `.vmdk` or `.vhdx` files if you only need to analyze a single disk, rather than the VM descriptor file. Understand the distinction between VM descriptor files and individual virtual disk files.
For command-line tools, use the `--plugin-path` argument or set the `DISSECT_PLUGINS` environment variable to point to your plugin directories. For the Python API, ensure your plugins are imported or registered appropriately within your code.
Familiarize yourself with the `Target` object's attributes and methods through the Python API documentation rather than assuming a direct one-to-one mapping with command-line tool functionality. The API provides more flexibility but requires a different approach than just porting CLI commands to Python.
Ensure `dissect.target` is installed in your active Python environment. If you want the full Dissect framework, use `pip install dissect` instead.
Verify that the provided path is correct and accessible. For example, check for typos, correct absolute/relative paths, and ensure necessary permissions to access the target file or device.
Review the input path(s) being provided to the `target-query` command or API call. Ensure paths are correctly formatted and do not contain unexpected characters or empty segments that could cause out-of-bounds access during internal string processing.
Check the target's operating system and version. Consult the `dissect.target` documentation for the specific plugin to understand its compatibility requirements. Ensure the target is of the type the plugin is designed for.
Verify the exact path of the registry key you are attempting to access. Registry paths are case-insensitive on Windows but may need to be precise. Use the `target-reg` command-line tool or `dissect.target`'s Python API to list existing keys and confirm the correct path.
No dependency data recorded yet.