3.25.1

What's Changed

• Make NTDS path lookup not crash by @Matthijsy in #1572
• Automatically YARA scan compressed files by decompressing them by @yunzheng in #1552
• Fix MSSQL log parser bug by @qmadev in #1393
• Bump deps for 3.25a by @twiggler in #1576

Full Changelog: 3.25...3.25.1

3.25

What's Changed

• Add new DirEntry class by @Schamper in #1389
• Fix output LNK plugin by @respondersGY in #1406
• Update requirements dissect.ntfs due to the DirEntry by @Miauwkeru in #1413
• Change python3.9 to python3.10 inside the on-demand-test pipeline by @Miauwkeru in #1404
• Unify webserver log path retrieval by @qmadev in #1287
• Add Defender MpCmdRun artifact parser by @JSCU-CNI in #1417
• Add support to zstd compress vmtar file and replace zstandard with backport.zstd by @william-billaud in #1380
• Fix record cache test by @Schamper in #1441
• Add support for dissect.apfs by @Schamper in #1365
• Fix bug in MsOffice plugin by @Poeloe in #1420
• Fix for empty RepoTags keyword in manifest.json for containers by @lhaagsma in #1449
• Add certlog plugin (ADCS database) by @william-billaud in #1443
• Add fingerprints to ssh plugin records by @JSCU-CNI in #1416
• Fix try_idna function in browser plugin in #1447
• Improve child detection for ESXi by @JSCU-CNI in #1440
• Add AD1 loader and filesystem by @JSCU-CNI in #1306
• Add magic helper module by @JSCU-CNI in #1387
• Improve Citrix Netscaler support by @JSCU-CNI in #1407
• Add loader for Netscaler techsupport collector files by @lhaagsma in #1373
• Add duplicate record name unit test by @B0TAxy in #1398
• Add target-inspect by @Schamper in #1374
• Add keychain support for decrypting FortiGate firmware files by @yunzheng in #1469
• Prevent target info crash by @william-billaud in #1470
• Fix issue with uac tar loader : add support for path starting with './' by @william-billaud in #1459
• Fix searching all namespaces for WMI consumer bindings and filters by @nbareil in #1383
• Use improved SQLite3 to automatically open sidecar WAL files by @PimSanders in #1454
• Add certificate parsing to webserver plugins by @JSCU-CNI in #1415
• Change the iis plugin log_dirs to check for the presence of W3SVC* directories by @Miauwkeru in #1460
• Make the cache compatible with iterators by @twiggler in #1482
• Fix ESXi configstore call in OS create method by @JSCU-CNI in #1499
• Add loader for ESXi vm-support by @william-billaud in #1492
• Normalize plugins Certificates output by @william-billaud in #1498
• Fix typo in Registry RunKey value for auto-start by @B0TAxy in #1503
• Fix invalid literals in activities cache by @twiggler in #1502
• Add compatibility for Firefox 147 by @JSCU-CNI in #1510
• Plugin for teamviewer incoming connections by @R3dP1ll in #701
• Skip nested objects of Velociraptor records by @respondersGY in #1480
• Add Microsoft Intune Management Extension log parsers by @d4ni-exe in #1399
• Fix duplicate mounting for virtual NTFS by @Politie-SOC in #1464
• Fix Symantec test by @JSCU-CNI in #1518
• Update vbox loader and virtualbox child for the VirtualBox descriptor update by @Miauwkeru in #1523
• Add individual hash command to target-shell by @skepppy in #1517
• Prevent fake NTFS filesystem mounts in target-mount by @Politie-SOC in #1520
• Search for additional command history on Citrix systems by @JSCU-CNI in #1501
• Fix ls output for files and make ls respect NO_COLOR by @skepppy in #1515
• Add support for --direct access for cim plugins by @william-billaud in #1437
• Update MacOS hostname parsing by @qmadev in #1536
• Fix mplog timestamp parsing to handle missing Z suffix and UTC offsets by @tuttimann in #1535
• Improve walkfs benchmark by @Schamper in #1537
• Fix #1538 : wget hsts plugin does not support explicit port number #1538 by @william-billaud in #1539
• Add tests data related to containers (EWF, VDI, VHD, VHDX and VMDK) by @william-billaud in #1495
• NTDS.dit Plugin by @B0TAxy in #1347
• Fix crash in linux.environ plugin when environ file is missing by @B0TAxy in #1504
• Restructure windows credential plugins by @JSCU-CNI in #1544
• Raise RuntimeError when missing a decompression package in open_decompress by @Miauwkeru in #1525
• Stop cmd_ls execution if the given path does not exist by @JSCU-CNI in #1553
• Add file type to walkfs by @Matthijsy in #1533
• Add mimetype detection to walkfs by @JSCU-CNI in #1521
• Use the target path type inside walkfs.py by @Miauwkeru in #1556
• Add support for VDI changes by @Schamper in #1531
• Reduce memory consumption etc.etc plugin and remove ConfigurationFilesystem by @Miauwkeru in #1549
• Add NTDS filesystem by @Schamper in #1483
• Add NTDS Group Policy records by @Matthijsy in #1559
• Add Safari browser history plugin by @LarsBehrens in #1565
• Stop messages plugin from parsing directories by @twiggler in #1575

New Contributors

• @nbareil made their first contribution in #1383
• @PimSanders made their first contribution in #1454
• @R3dP1ll made their first contribution in #701
• @d4ni-exe made their first contribution in #1399
• @Politie-SOC made their first contribution in #1464
• @tuttimann made their first contribution in #1535
• @LarsBehrens made their first contribution in #1565

Full Changelog: 3.24...3.25

3.24

What's Changed

• Fix moved dissect.ntfs import by @Schamper in #1322
• Use dependency groups and update Ruff by @Schamper in #1294
• Deduplicate DPAPI MasterKey decryption attempts by @JSCU-CNI in #1162
• Better error handling for invalid paths and broken loaders by @JSCU-CNI in #1319
• Small Sphinx rst improvements by @JSCU-CNI in #1325
• Add Apple Sparse Image Format (ASIF) container by @Schamper in #1324
• Improve parsing of systemd-logind fields in AuthPlugin by @JSCU-CNI in #1328
• Clarify Windows application installation date by @respondersGY in #1337
• Upgrade flow.record to version 3.20 by @respondersGY in #1339
• Add timestamp to MUIcache plugin by @respondersGY in #1336
• Find local hard disks when running inside a qemu/kvm virtual machine by @Miauwkeru in #1228
• Check whether the target_path is a symlink or not by @Miauwkeru in #1340
• Only output export functions os_info by @respondersGY in #1338
• Update pyproject.toml license settings and minimum python version by @Miauwkeru in #1333
• Reduce the memory consumption of the tests by @Miauwkeru in #1341
• Add Support for KAPEs that are in the VHD format by @Aevyz in #1327
• Add timestamp to yara plugin by @Matthijsy in #1344
• Used volume SERIAL as UUID when it didnt exist by @loaflover in #1303
• Extend child-support by @lhaagsma in #1133
• Make syslog parsing optional by @twiggler in #1305
• Improve ChromiumMixin performance by @JSCU-CNI in #1251
• Fix target-shell info cmd and add testcase by @lhaagsma in #1356
• Add CramFS implementation by @Horofic in #1308
• Add better exception handling for openssh key parsing by @JSCU-CNI in #1361
• Fix IIS compatibility by @qmadev in #1364
• Add VMware Workstation inventory parser function by @JSCU-CNI in #1274
• Add support for latest Firefox version by @JSCU-CNI in #1363
• Add output redirection to target-shell by @twiggler in #1351
• Make ESXi OS plugin compatible with live collection by @william-billaud in #1352
• Yield files inside recyclebin $R directories related to their $I entries by @Miauwkeru in #1377
• Add example VS Code debug configuration by @Schamper in #1379
• Add Windows Search Index plugin by @JSCU-CNI in #1254
• Add xattr, suid and capability functionality to WalkFsPlugin by @JSCU-CNI in #1144
• Support environment variable for keychain values by @twiggler in #1360
• Run keychain test isolated by @twiggler in #1394
• Add workaround for pypy bytes(.) conversion bug by @twiggler in #1388
• Cleanup tools directory and add trace logging by @Schamper in #1370
• Bump flow.record to version 3.21 by @Miauwkeru in #1400
• Replace dissect.sql and dissect.esedb with dissect.database by @Schamper in #1346
• Bump dissect package dependencies by @Miauwkeru in #1401

New Contributors

• @Aevyz made their first contribution in #1327
• @loaflover made their first contribution in #1303

Full Changelog: 3.23.1...3.24

3.23.1

What's Changed

• Fix incorrect timestamps of ZipInfo objects by @william-billaud in #1315
• Fix namespace function output being incorrectly set to None by @Schamper in #1320

Full Changelog: 3.23...3.23.1

3.23

What's Changed

• Fix target-dump arguments parsing by @Miauwkeru in #1150
• Allow mounting btrfs subvolumes with target-mount by @Miauwkeru in #1149
• Add plugin to parse recentlyused.xbel files from Linux desktops by @syzzer in #715
• Fix log loader deprecation message by @twiggler in #1159
• Slightly better error messages for plugin function errors by @JSCU-CNI in #1161
• cam.registry assumed wrong part of path as device by @lhaagsma in #1157
• Fix processing empty commands in runkeys plugin by @twiggler in #1183
• Lower target mount cache by @twiggler in #1153
• Rename Prefetch Grouped Record by @YahavArm in #1176
• Add Winlogon DPAPI keyprovider by @JSCU-CNI in #1151
• Add os_tree function in OSPlugin by @Miauwkeru in #1188
• Add tests for SquashFSFilesystem by @JSCU-CNI in #1173
• Fix is_tar_magic by @JSCU-CNI in #1170
• Autouse guarded keychain in tests by @Schamper in #1217
• Limit parse_unix_dhcp_log_messages in parsed syslog messages by @JSCU-CNI in #1205
• Add creation date to the sam plugin by @qmadev in #1210
• Make the usage of --list consistent by @Miauwkeru in #1196
• Fix/refactor tasks plugin output by @B0TAxy in #1184
• Stop consuming arguments for each plugin by @Miauwkeru in #1187
• Add enhancements for target-dump by @Miauwkeru in #1166
• Remove apps/database folder by @Horofic in #1198
• Add benchmark test for acquire tar by @Matthijsy in #1225
• Add Acquire collection loader by @Matthijsy in #935
• Added support for voidtools everything DB by @cobyge in #515
• Parse dynamic configuration data from /proc/net by @twiggler in #1177
• Search additional paths for home directories by @twiggler in #1207
• Add programmatic support for nested namespaces by @Miauwkeru in #1175
• Make lookup of Windows directory resilient by @twiggler in #1229
• Small shell improvements by @JSCU-CNI in #1174
• Add Splashtop plugin by @bobkarreman in #1233
• Fix inconsistent duplicate field mappings in various plugins (part 2) by @JSCU-CNI in #1189
• Add record field type tests by @JSCU-CNI in #1192
• Add loader for Unix-like Artifacts Collector by @william-billaud in #1243
• Add Podman and OCI container support by @JSCU-CNI in #1096
• Fix logic flaw in _filter_compatible by @JSCU-CNI in #1247
• Fix EOFError for small targets in VbkFilesystem.detect by @JSCU-CNI in #1256
• Add support for Hyper-V backups to VBK loader by @Zawadidone in #1204
• Only readline escape ANSI colors if we actually have readline by @Schamper in #1257
• Make target-shell disks, volumes and mounts output consistent by @Miauwkeru in #1248
• Move DPAPI keyproviders to nested namespaces by @JSCU-CNI in #1250
• Fix firefox tests for dissect.sql bugfix by @JSCU-CNI in #1258
• Add additional VBK tests by @Schamper in #1261
• Fix incorrect timestamps of ZipInfo objects by @respondersGY in #1270
• Fix NamespacePlugin usage and add tests by @JSCU-CNI in #1259
• s/Resources/References/g by @JSCU-CNI in #1273
• Refactor Windows Firewall plugin by @JSCU-CNI in #1142
• Add record output and regex needle support to qfind by @JSCU-CNI in #1103
• Add Windows product key plugin by @JSCU-CNI in #1239
• Fix Linux process start time TypeError by @qmadev in #1272
• Allow glob in path argument of target-fs by @Matthijsy in #1147
• Fix target-fs test poluting current working directory by @Schamper in #1279
• Improve webserver plugins by @respondersGY in #1277
• Change empty volume logging by @Schamper in #1211
• Move order of Velociraptor and ZIP loaders by @Matthijsy in #1283
• Add the description field to the Windows plugin services by @reynas in #1275
• Cross lookup windows user name from sam by @twiggler in #1252
• Improve robustness EVTX plugin by @respondersGY in #1268
• Sync RustDesk paths with Acquire by @qmadev in #1286
• Let QCow2Container init to pass fh directly as Path by @andreia-oca in #1160
• Compatibility with dissect.vmfs rewrite by @Schamper in #1208
• Allow plugins to re-use arguments from main tools by @Schamper in #1262
• Fix various loader and unit test inconsistencies by @Schamper in #1265
• Add dissect.sql to dependencies by @qmadev in #1298
• Improve robustness of lazy import by @Schamper in #1263
• Check for optional dependencies by @JSCU-CNI in #1194
• Update INode imports qnxfs by @Miauwkeru in #1304
• Pin zstandard and remove superfluous comment by @twiggler in #1307
• Fix linux services plugin by @JSCU-CNI in #1253
• Extend mru plugin to parse OpenSavePidlMRU and LastVisitedPidlMRU keys by @M1ra1B0T in #1061
• Move DHCP lease file parsing to new Linux Network plugin by @Horofic in #1240
• Fix extfs mock by @twiggler in #1310
• Enhance cim plugins (WMI) #1244 by @william-billaud in #1245
• Add string matches to yara output by @JSCU-CNI in #1313
• Include OSPlugin functions in find_functions output by @JSCU-CNI in #1135
• Bump dependencies by @twiggler in #1314

New Contributors

• @YahavArm made their first contribution in #1176
• @B0TAxy made their first contribution in #1184
• @bobkarreman made their first contribution in #1233
• @respondersGY made their first contribution in #1270
• @reynas made their first contribution in #1275
• @andreia-oca made their first contribution in #1160

Full Changelog: 3.22...3.23

3.22

What's Changed

• Add container image support by @JSCU-CNI in #1000
• Improve ApachePlugin log file discovery by @JSCU-CNI in #980
• feature: add nlink support for jffs stat by @twiggler in #1064
• Add Apache VirtualHost parsing by @JSCU-CNI in #1077
• Add support for leap days in year_rollover_helper by @JSCU-CNI in #1081
• Add Cellebrite UFDX and UFD loader by @JSCU-CNI in #1086
• Add Windows MSN plugin by @JSCU-CNI in #1084
• Add fixes for target-shell prompt by @Miauwkeru in #943
• Replace ip and network with ipinterface inside interface records by @Miauwkeru in #1057
• Nfs filesystem by @twiggler in #1022
• Improve GenericTarSubloader for Windows-like tarballs by @JSCU-CNI in #1076
• Add pytest-xdist to tox and run multi-threaded by @JSCU-CNI in #1089
• Improve various Windows LSA and DPAPI internals by @JSCU-CNI in #1071
• Improve target-query exception handling and logging by @JSCU-CNI in #1062
• Improve Linux authlog IP address parsing by @JSCU-CNI in #1072
• Add order field to command history records by @JSCU-CNI in #1068
• Improve NGINX plugin by @JSCU-CNI in #1073
• Add Windows RDP bitmap cache plugin by @JSCU-CNI in #1080
• Add unlock_with_fvek to BitlockerVolumeSystem by @JSCU-CNI in #1092
• Translate empty Windows evtx value to None by @JSCU-CNI in #1058
• Fix TeamViewer timezone parsing by @JSCU-CNI in #1069
• Target reload by @twiggler in #1090
• Add Oracle VirtualBox child support by @JSCU-CNI in #1095
• Added new mft.body plugin by @qmadev in #1063
• Improve RedHat OS detection by @JSCU-CNI in #1079
• Improve robustness of Sophos plugin by @Zawadidone in #1083
• Improve detection for iOS targets by @JSCU-CNI in #1085
• Add support for Anydesk filetransfertrace files by @lhaagsma in #1098
• Allow namespaces to accept arguments by @Schamper in #1101
• Add rustdesk (resolved feedback on previous PR) by @lhaagsma in #1104
• Change linter to Ruff by @Schamper in #1097
• Add .git-blame-ignore-revs file by @Schamper in #1105
• Fix multiple namespace plugins in same file by @Schamper in #1102
• Clear cached functions on every test by @Schamper in #1110
• Add other Windows Defender quarantine file stream IDs by @skepppy in #1108
• Add support for dissect.qnxfs by @Schamper in #454
• Improve UNIX domain parsing by @JSCU-CNI in #1114
• Improve Apache log format detection by @JSCU-CNI in #1116
• Mount NFS shares on ESXi by @twiggler in #1094
• Add children argument to target-info tool by @JSCU-CNI in #1113
• Add parser for PcaGeneralDb*.txt files by @Schamper in #1100
• Fix bug in kape loader when using with target-mount by @william-billaud in #1106
• Add loader for VBK files by @Matthijsy in #1012
• Fix lsa.secrets plugin and improve tests by @JSCU-CNI in #1120
• Add workaround for ANSI codes target-shell tests by @JSCU-CNI in #1117
• Remove UTC class usage in exFAT code by @Schamper in #1125
• Improve pytest warning on missing test data by @Schamper in #1119
• Add Rapid7 Velociraptor artifacts plugin by @Zawadidone in #698
• Improve plugin arguments by @JSCU-CNI in #1070
• Add support for decrypting Chrome and Edge v20 cookies and passwords by @JSCU-CNI in #1121
• Single (log) files, take two by @twiggler in #1082
• Compatibility with refactored dissect.regf by @Schamper in #1131
• Add Capability History plugin by @lhaagsma in #1112
• Raise a NotADirectoryError inside the NFSFilesystemEntry.get when it is a file by @Miauwkeru in #1109
• Add some benchmarks by @JSCU-CNI in #1129
• Fix default Docker daemon data directories by @Zawadidone in #1138
• Add Colima children plugin by @Zawadidone in #1139
• Add checks for a windows UTC timezone inside windows datetime by @Miauwkeru in #1141
• Fix invalid IP address assignment in Windows network plugin by @JSCU-CNI in #1143
• Return an empty dict if the plistnetwork happened to be None by @Miauwkeru in #1145
• Support systemd drop files by @twiggler in #1136
• Update pyproject.toml for release by @Miauwkeru in #1148

New Contributors

• @lhaagsma made their first contribution in #1098
• @skepppy made their first contribution in #1108
• @william-billaud made their first contribution in #1106

Full Changelog: 3.21...3.22

3.21

What's Changed

• Improve SQLite table exist checks by @JSCU-CNI in #958
• Add support for ISO 8601 timestamps in syslogs by @JSCU-CNI in #907
• Improve cit plugin exception handling by @JSCU-CNI in #961
• Improve catroot plugin exception handling by @JSCU-CNI in #962
• Improve lnk plugin exception handling by @JSCU-CNI in #963
• Add target-diff by @JSCU-CNI in #664
• Fix Sphinx warnings by @JSCU-CNI in #942
• Strip trailing dir separator for translated file paths in ITunesLoader by @Poeloe in #952
• Parse hostname from /proc/sys/kernel/hostname by @CinisSec in #704
• Add support for Fortinet AES encrypted firmware images by @yunzheng in #969
• Remove paho from mqqt unit test by @twiggler in #967
• Fix URL-encoded filesystem entries in the Velociraptor loader by @Zawadidone in #700
• Add Unix DHCP lease file parser for target.ips by @JSCU-CNI in #965
• Make Mssql errorlog plugin more robust by @Horofic in #978
• Unify digest field names across the project by @JSCU-CNI in #982
• Continue parsing tasks after invalid Windows XML Task by @Horofic in #986
• Fix argument checks in env plugin by @JSCU-CNI in #988
• Add None checks around read_sid by @JSCU-CNI in #989
• Add New Capability Access Manager plugin by @qmadev in #979
• Add warning for OBJECT_UNUSED in journal plugin by @JSCU-CNI in #971
• Fix inconsistent duplicate field mappings in various plugins by @JSCU-CNI in #990
• Fix file header detection in open_decompress by @yunzheng in #998
• Fix crash in unix users plugins if GID or UID is empty by @wbi-ocd in #996
• Fix ANSI color prompt in target-shell by @yunzheng in #1004
• Add Windows 11 Prefetch version by @Horofic in #1005
• Don't attempt to load child targets when initial target loading fails by @JSCU-CNI in #987
• Normalize UTC timezone names for unix and windows targets by @JSCU-CNI in #1001
• Initial commit for plugin internals refactor by @Schamper in #763
• Prevent enumerating entire non-ISO formatted syslog files in is_iso_fmt by @JSCU-CNI in #972
• Add Kape VHDX loader by @qmadev in #993
• Improve compatibility checks on various plugins by @JSCU-CNI in #1008
• Attempt to load previous snapshot VMDK when missing snapshot disks by @Schamper in #1011
• Microsoft Office add-in detection by @twiggler in #966
• POC: Pure Python NFS client by @twiggler in #997
• Improve target-diff tool by @JSCU-CNI in #1014
• Add FortiGate decryption keys up to v7.0.17, v7.2.10, v7.4.6 and v7.6.1 by @yunzheng in #1016
• Move 7-Zip and WinRAR plugins to productivity namespace by @JSCU-CNI in #1017
• Fix compatibility with latest flow.record by @JSCU-CNI in #1018
• Fix sphinx docs warnings by @JSCU-CNI in #1020
• Improve Linux detection by @JSCU-CNI in #1023
• Add support for plugin directories by @Schamper in #788
• Parse recycle bins from non sysvol volumes by @Zawadidone in #1026
• Fix parent plugin namespaces by @Schamper in #1024
• Add proper datetime conversion for StartTime and EndTime in the sru plugin by @Miauwkeru in #1025
• Move tasks and defender plugin into plugin directories by @Schamper in #1028
• Add additional profile parsing to Chromium browsers by @qmadev in #1031
• Unify -L loader argument as a generic argument by @Schamper in #1033
• Revert "Fix ANSI color prompt in target-shell" by @yunzheng in #1040
• Bump the flow.record dependency to version 3.19 by @Miauwkeru in #1037
• Add Python 3.13 compatibility by @JSCU-CNI in #897
• Add exception to Kape VHDX loader by @qmadev in #1047
• Refactor unix cronjob plugin by @JSCU-CNI in #1009
• Add "alias" to FunctionDescriptor and "required" field to arguments by @JSCU-CNI in #1043
• Add support for kernel log entries in syslog by @JSCU-CNI in #1050
• Improve Linux services parsing by @JSCU-CNI in #1049
• Clean up some files by @Schamper in #1052
• Add retrieval of runtime information to plugin descriptors by @Schamper in #1007
• Sanitize linux and windows hostnames by @JSCU-CNI in #1051
• Fix compatible plugins filter by @JSCU-CNI in #1054
• Improve Android OS detection by @JSCU-CNI in #1053
• Parse Docker container environment variables by @JSCU-CNI in #1055
• Add readline ignore sequences to PS1 prompt by @yunzheng in #1041
• Add qfind plugin and tool by @Schamper in #1035
• Fix compatible plugins filter (2) by @JSCU-CNI in #1059

New Contributors

• @CinisSec made their first contribution in #704
• @qmadev made their first contribution in #979

Full Changelog: 3.20.1...3.21

3.20.1

What's Changed

• Add more FortiGate firmware decryption keys by @yunzheng in #954
• Linux network plugin: NetworkManager & systemd-networkd by @twiggler in #932
• Fix issue with pathless config items by @cecinestpasunepipe in #785
• Add support for mounted GNOME Trash folders by @JSCU-CNI in #906
• Allow RegfValue.type to fall back to int by @JSCU-CNI in #956
• Fix error in windows network plugins by @wbi-ocd in #955

New Contributors

• @wbi-ocd made their first contribution in #955

Full Changelog: 3.20...3.20.1

3.20

What's Changed

• Add birthtime_ns and nr of blocks and blocksize to btrfs stat output by @Miauwkeru in #838
• Add option to unset allow_other option for FUSE for target-mount by @Poeloe in #844
• Dis 3281/improved security scheme by @twiggler in #847
• [Bug] Add missing _target field to record for Defender exclusion plugin by @DevJoost in #845
• Add Windows network interface plugin by @narimantos in #830
• Improve argument parsing of the mqtt loader by @twiggler in #850
• Move source field of COMMON_INTERFACE_ELEMENTS to the bottom by @Miauwkeru in #862
• Improve running docker container parsing by @JSCU-CNI in #853
• Correctly mount file mount points in Overlay2Filesystem by @JSCU-CNI in #858
• Add macOS network interface plugin by @cecinestpasunepipe in #839
• Add Unix trash plugin by @JSCU-CNI in #852
• Make cloud-init log line regex more strict by @JSCU-CNI in #864
• Mark OSX home directory as a posix path by @twiggler in #867
• Unfold ADS macb records by @cecinestpasunepipe in #861
• Add support for runtime aliases to target_shell by @cecinestpasunepipe in #871
• Move helpers/network_manager.py to plugins/os/unix/linux/network_manager.py by @Miauwkeru in #869
• Add Parallels child detection by @JSCU-CNI in #855
• Add support for targetrc file to execute commands when a target shell is spawned by @twiggler in #859
• Add improvements for VMware Workstation by @JSCU-CNI in #854
• Add -c argument to target-shell by @cecinestpasunepipe in #873
• Add birthtime_ns to ExtFilesystemEntry.lstat by @Miauwkeru in #876
• Explicitly mark home directories as having a posix or windows flavor by @twiggler in #892
• Add XFS metadata: number of blocks per file. by @twiggler in #874
• Add birthtime, blocksize and blks to stat output for NTFS by @Miauwkeru in #848
• Improve shellbags plugin by @JSCU-CNI in #470
• Add binary configuration parser by @cecinestpasunepipe in #893
• Add Env ConfigurationParser by @JSCU-CNI in #733
• Map all registry value types to a standardized enum in regutil by @cecinestpasunepipe in #899
• Fix broken python command in target-shell by @JSCU-CNI in #905
• Add wget hsts plugin by @JSCU-CNI in #868
• Improve robustness of journal plugin by @JSCU-CNI in #872
• Add support for compressed cloud-init file log parsing by @JSCU-CNI in #902
• Support st_blksize and st_blocks on JFFS2 by @twiggler in #912
• Small log improvements by @JSCU-CNI in #857
• Add missing init file by @JSCU-CNI in #916
• Improve exported plugin docstrings and annotations by @JSCU-CNI in #725
• Fix registry for legacy Windows versions by @cecinestpasunepipe in #914
• Restructure editor plugin namespace by @JSCU-CNI in #915
• Add Unix and Windows application plugins by @JSCU-CNI in #851
• Update Windows timezone db to version 2024b by @JSCU-CNI in #919
• Add json output to target-query --list by @JSCU-CNI in #841
• Add Proxmox support by @Schamper in #837
• Add blksize, nblocks, and birthtime_ns to stat for FFS by @twiggler in #917
• Refactor AuthLogPlugin by @Poeloe in #860
• Improve Linux utmp plugin by @JSCU-CNI in #923
• Improve FortiManager OS support by @JSCU-CNI in #921
• Fix inconsistency of target.ips output by @JSCU-CNI in #870
• Remove Python 2 compatible exception code by @Schamper in #930
• Fix default argument for following symlinks in JFFS by @Schamper in #925
• Add computer SID for Windows systems by @fox-evv in #824
• Make filesystem exceptions subclass from standard library exceptions by @Schamper in #928
• Fix AttributeError in syscache plugin by @JazzCore in #913
• Reflect move of XVA and VMA to dissect.archive by @Schamper in #937
• Make WER file field names with non-ascii characters usable by @pyrco in #938
• Add st_blocks and st_blksize to stat output for FAT by @cecinestpasunepipe in #941
• Fix parsing journal entries when the value is 'None' by @h0ckeyst1ck in #944
• Fix a regression bug inside windows network_manager by @Miauwkeru in #936
• Added support for MSSQL error log files by @fox-evv in #823
• Add FortiOS test by @JSCU-CNI in #945
• Bump the flow.record dependency to version 3.18 by @pyrco in #946
• Add a dependency on dissect.fve for the full extra by @pyrco in #949

New Contributors

• @twiggler made their first contribution in #847
• @fox-evv made their first contribution in #824

Full Changelog: 3.19...3.20

3.19

What's Changed

• Add username and password options to MQTT loader by @cecinestpasunepipe in #732
• Make ESXi Plugin work without crypto and fix vm_inventory by @Matthijsy in #697
• Fix visual bugs in cyber by @Schamper in #738
• Improve type hint in Defender plugin by @Schamper in #739
• Fix issue with MPLogs by @cecinestpasunepipe in #742
• Use target logger in etc-plugin by @cecinestpasunepipe in #741
• Fix TargetPath instances for configutil.parse by @Miauwkeru in #743
• Fix for using the correct volume name to mount filesystems in Unix by @Schamper in #677
• Fix NoneType AttributeError in firefox extension plugin by @M1ra1B0T in #713
• Fix issue with namespaced plugins in target-shell by @cecinestpasunepipe in #751
• Add retrieval browser data "Snapshots" folder by @mick-314 in #680
• Move helpers from './helpers/ssh.py' into './plugins/apps/ssh/ssh.py' by @Poeloe in #756
• Add support for passwd backup files by @JSCU-CNI in #760
• Improve AnyDesk plugin by @JSCU-CNI in #712
• Fix wrong log logic indicating a sysvol was not found by @pyrco in #762
• Add _target field to firefox and chromium plugins by @DevJoost in #764
• Fix directory argument for lnk plugin by @Poeloe in #757
• Add CSV-ish config parser by @cecinestpasunepipe in #754
• Add support for Android Backups by @Schamper in #419
• Fix UTM loader to skip non-disks by @Schamper in #769
• Add support for mounting by XFS label by @Schamper in #768
• Improve YARA plugin by @JSCU-CNI in #646
• Improve DHCP IP address parsing speed for journal by @JSCU-CNI in #687
• Rewrite Windows USB plugin by @JSCU-CNI in #766
• Add MACB aggregator to MFT by @cecinestpasunepipe in #767
• Add ls parameters to target-fs by @DevJoost in #716
• Fix MdVolumeSystem by @Miauwkeru in #782
• Add option to scan children in YARA plugin by @JSCU-CNI in #780
• Add support for Firefox Oculus VR browser by @Schamper in #752
• Fix ESXi OS when no local state exists yet by @Schamper in #784
• Add --root to the etc plugin by @Miauwkeru in #783
• Add loader option to target-info and target-yara by @JSCU-CNI in #781
• Make adding virtual NTFS filesystem more resilient by @Schamper in #691
• Add target-shell history by @JSCU-CNI in #786
• Cast custom --max-size to integer in yara plugin by @JSCU-CNI in #811
• Yield MFT segments in specified range by @Zawadidone in #672
• Add libvirt loader and QEMU child plugin by @Miauwkeru in #654
• Create base class for the network plugin by @Miauwkeru in #810
• Add symlink support to ZipFilesystem by @Schamper in #808
• Add st_birthtime_ns to fsutil.stat_result by @Poeloe in #814
• Refactor target-shell by @JSCU-CNI in #812
• Add Windows Jumplist plugin by @Zawadidone in #669
• Add Windows Update Agent history by @michoebey in #770
• Add parser for unsaved Windows Notepad tabs by @joost-j in #540
• Move notepad test files to LFS by @Schamper in #825
• Prevent unhandled filesystem exceptions in modify_record by @JSCU-CNI in #737
• Improve parsing speed of walkfs plugins by @JSCU-CNI in #749
• Fix relative symlinks within a mounted filesystem by @Schamper in #832
• Add notice for PyPy users by @cecinestpasunepipe in #829
• Move jumplist test data to correct location by @Schamper in #835
• Add MacOS and Linux paths to TeamViewer plugin by @Poeloe in #834
• Add unit test to ensure Git LFS consistency by @Schamper in #828
• Improve Linux OS detection by @Horofic in #809
• Add mutual exclusive plugin arguments by @cecinestpasunepipe in #836
• Generic locale fixes for RHEL by @JSCU-CNI in #840
• Fix 3.12 ET and datetime deprecation warnings by @JSCU-CNI in #842
• Improve DPAPI plugin by @JSCU-CNI in #711
• Bump the version of flow.record to 3.16 by @pyrco in #843

New Contributors

• @Matthijsy made their first contribution in #697
• @mick-314 made their first contribution in #680
• @michoebey made their first contribution in #770
• @joost-j made their first contribution in #540

Full Changelog: 3.18...3.19