dissect.hypervisor

What it is and what it does

dissect.hypervisor is a specialized parser module within the Dissect forensic framework that reads and extracts data from hypervisor-related files—disk images, backup archives, and configuration files—across different virtualization platforms. It's designed for forensic investigators, incident responders, and system administrators who need to inspect virtual machine artifacts and hypervisor state without running the hypervisor itself.

The module integrates with the broader Dissect ecosystem, relying on defusedxml for safe XML parsing and dissect.cstruct for binary structure handling. It's actively maintained, marked as production-stable, and requires Python 3.10 or later. The AGPL-3.0-or-later license means any modifications must be shared under the same terms.

Use it for:

• Extract and analyze virtual machine disk images during forensic investigations to recover deleted files or system state
• Parse hypervisor backup files to inspect VM configurations and snapshots without restoring the full backup
• Examine hypervisor configuration files to audit virtual infrastructure and detect unauthorized changes
• Integrate hypervisor parsing into automated incident response workflows as part of the Dissect framework

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Parses hypervisor disk, backup, and configuration files from various virtualization platforms, extracting structured data for forensic analysis and system inspection.

Yes, if you are working in forensics, incident response, or system auditing and need to parse hypervisor artifacts. The low install friction, active maintenance, and stable status make it reliable. The AGPL-3.0-or-later license is a blocker only if you need to keep modifications proprietary; otherwise it's a standard choice for open-source security tooling.

Install

dissect-hypervisor on PyPI

pip install dissect-hypervisor

uv add dissect-hypervisor

poetry add dissect-hypervisor

Installing dissect.hypervisor

Before you install

Low install friction with a pure-Python wheel distribution. Actively maintained with recent commits and stable production status. Requires Python 3.10 or later.

License in practice

Licensed under AGPL-3.0-or-later, which requires derivative works and modifications to be released under the same license and made available to users. Suitable for internal tools and open-source projects, but not for proprietary closed-source software.

Quickstart

pip install dissect.hypervisor

from dissect.hypervisor import hypervisor

# Parse hypervisor configuration or disk files
parser = hypervisor.HypervisorParser()
result = parser.parse(file_path)

Requires Python 3.10 or later; depends on defusedxml and dissect.cstruct packages being available.

Verify before relying

• Which specific hypervisor platforms and file formats are supported by this version
• Whether defusedxml and dissect.cstruct are available and compatible with Python 3.10+

Package facts

Evidence: dissect_hypervisor-3.21-py3-none-any.whl

Tags

More Utilities packages