dissect.hypervisor
A Dissect module implementing parsers for various hypervisor disk, backup and configuration files
Decision gist · record as of 2026-08-14
Yes, if you are working in forensics, incident response, or system auditing and need to parse hypervisor artifacts. The low install friction, active maintenance, and stable status make it reliable. The AGPL-3.0-or-later license is a blocker only if you need to keep modifications proprietary; otherwise it's a standard choice for open-source security tooling.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python 3.10 or later; depends on defusedxml and dissect.cstruct packages being available.
- Low install friction with a pure-Python wheel distribution.
- Actively maintained with recent commits and stable production status.
License · maintenance · safety
AGPL-3.0-or-later (agpl) — Licensed under AGPL-3.0-or-later, which requires derivative works and modifications to be released under the same license and made available to users. Suitable for internal tools and open-source projects, but not for proprietary closed-source software.
last release 2026-02-24 (171 days) · last repo commit 2026-07-28 · 12 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 97,610 downloads/mo, #13,141 on PyPI
Alternatives
Verify before relying
pip install dissect.hypervisor
from dissect.hypervisor import hypervisor
# Parse hypervisor configuration or disk files
parser = hypervisor.HypervisorParser()
result = parser.parse(file_path)- Which specific hypervisor platforms and file formats are supported by this version
- Whether defusedxml and dissect.cstruct are available and compatible with Python 3.10+
What it is and what it does
dissect.hypervisor is a specialized parser module within the Dissect forensic framework that reads and extracts data from hypervisor-related files—disk images, backup archives, and configuration files—across different virtualization platforms. It's designed for forensic investigators, incident responders, and system administrators who need to inspect virtual machine artifacts and hypervisor state without running the hypervisor itself.
The module integrates with the broader Dissect ecosystem, relying on defusedxml for safe XML parsing and dissect.cstruct for binary structure handling. It's actively maintained, marked as production-stable, and requires Python 3.10 or later. The AGPL-3.0-or-later license means any modifications must be shared under the same terms.
Use it for
- Extract and analyze virtual machine disk images during forensic investigations to recover deleted files or system state
- Parse hypervisor backup files to inspect VM configurations and snapshots without restoring the full backup
- Examine hypervisor configuration files to audit virtual infrastructure and detect unauthorized changes
- Integrate hypervisor parsing into automated incident response workflows as part of the Dissect framework
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you are working in forensics, incident response, or system auditing and need to parse hypervisor artifacts.
The low install friction, active maintenance, and stable status make it reliable. The AGPL-3.0-or-later license is a blocker only if you need to keep modifications proprietary; otherwise it's a standard choice for open-source security tooling.
Install
dissect-hypervisor on PyPI
Before you install
Low install friction with a pure-Python wheel distribution. Actively maintained with recent commits and stable production status. Requires Python 3.10 or later.
Requires Python 3.10 or later; depends on defusedxml and dissect.cstruct packages being available.
License in practice
Licensed under AGPL-3.0-or-later, which requires derivative works and modifications to be released under the same license and made available to users. Suitable for internal tools and open-source projects, but not for proprietary closed-source software.
Quickstart
pip install dissect.hypervisor
from dissect.hypervisor import hypervisor
# Parse hypervisor configuration or disk files
parser = hypervisor.HypervisorParser()
result = parser.parse(file_path)Verify before relying
- Which specific hypervisor platforms and file formats are supported by this version
- Whether defusedxml and dissect.cstruct are available and compatible with Python 3.10+
Package facts
| License | AGPL-3.0-or-later agpl |
| Python support | Supports the current Python release >=3.10 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 3 packagesdefusedxmldissect.cstructdissect.util |
| Maintenance | Actively maintained 171 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 97,610 / month, #13,141 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 5 - Production/StableEnvironment :: ConsoleIntended Audience :: DevelopersIntended Audience :: Information TechnologyOperating System :: OS IndependentProgramming Language :: Python :: 3Topic :: Internet :: Log AnalysisTopic :: Scientific/Engineering :: Information AnalysisTopic :: SecurityTopic :: Utilities |
Evidence: dissect_hypervisor-3.21-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “hypervisor file parsing”
- dissect.hypervisorParses hypervisor disk, backup, and configuration files from various…
- pyobjc-framework-VirtualizationProvides Python bindings to macOS's Virtualization framework,…
- libvirt-pythonProvides Python bindings to the libvirt virtualization API, allowing…
Give your agent the search over MCP, or paste the wish link into any chat.
More Utilities packages
Converts domain names between Unicode and ASCII-compatible encoding (Punycode) according to IDNA 2008 and Unicode Technical Standard 46, with security validation and broader script coverage than the standard library.
Install it if you work with internationalized domain names, need to validate domains, or use HTTP clients that depend on it transitively.
Detects and normalizes text encoding from unknown or ambiguous sources, supporting all IANA character sets that Python's core library provides codecs for, with the ability to register custom codecs.
Setuptools is a Python build backend and package management tool that handles building, distributing, and installing Python packages, including support for C/C++ extension modules.
Pluggy provides a plugin system that lets you define hook specifications and register implementations to be called in sequence, enabling extensible Python applications without tight coupling.
Install it if you're building an extensible application or framework.
Pygments is a syntax highlighter that colorizes source code and text in over 500 languages and formats, outputting to HTML, LaTeX, RTF, SVG, images, or ANSI terminal sequences.
Install it if you need to display or transform source code.
Six provides utility functions to write Python code that runs on both Python 2.7 and Python 3.3+, smoothing over language differences between the two versions.
See also acquire · dissect.ntfs · dissect.target · dissect.util · dissect.volume · dissect.cstruct · pyiosbackup · bloodhound · yara-x · borgbackup