---
id: dissect-hypervisor
version: "3.21"
license: AGPL-3.0-or-later
license_treatment: agpl
maintenance: active
---

# dissect.hypervisor — A Dissect module implementing parsers for various hypervisor disk, backup and configuration files

License: agpl · Maintenance: active · Downloads: 97.6K/mo

## What it is and what it does

dissect.hypervisor is a specialized parser module within the Dissect forensic framework that reads and extracts data from hypervisor-related files—disk images, backup archives, and configuration files—across different virtualization platforms. It's designed for forensic investigators, incident responders, and system administrators who need to inspect virtual machine artifacts and hypervisor state without running the hypervisor itself.

The module integrates with the broader Dissect ecosystem, relying on defusedxml for safe XML parsing and dissect.cstruct for binary structure handling. It's actively maintained, marked as production-stable, and requires Python 3.10 or later. The AGPL-3.0-or-later license means any modifications must be shared under the same terms.

Use it for:

- Extract and analyze virtual machine disk images during forensic investigations to recover deleted files or system state
- Parse hypervisor backup files to inspect VM configurations and snapshots without restoring the full backup
- Examine hypervisor configuration files to audit virtual infrastructure and detect unauthorized changes
- Integrate hypervisor parsing into automated incident response workflows as part of the Dissect framework

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Parses hypervisor disk, backup, and configuration files from various virtualization platforms, extracting structured data for forensic analysis and system inspection.

Yes, if you are working in forensics, incident response, or system auditing and need to parse hypervisor artifacts. The low install friction, active maintenance, and stable status make it reliable. The AGPL-3.0-or-later license is a blocker only if you need to keep modifications proprietary; otherwise it's a standard choice for open-source security tooling.

## Install

pip install dissect-hypervisor
uv add dissect-hypervisor
poetry add dissect-hypervisor

## Installing dissect.hypervisor

Before you install: Low install friction with a pure-Python wheel distribution. Actively maintained with recent commits and stable production status. Requires Python 3.10 or later.

License in practice: Licensed under AGPL-3.0-or-later, which requires derivative works and modifications to be released under the same license and made available to users. Suitable for internal tools and open-source projects, but not for proprietary closed-source software.

Quickstart:

pip install dissect.hypervisor

from dissect.hypervisor import hypervisor

# Parse hypervisor configuration or disk files
parser = hypervisor.HypervisorParser()
result = parser.parse(file_path)

Requires Python 3.10 or later; depends on defusedxml and dissect.cstruct packages being available.

Verify before relying:

- Which specific hypervisor platforms and file formats are supported by this version
- Whether defusedxml and dissect.cstruct are available and compatible with Python 3.10+

## Package facts

- License: AGPL-3.0-or-later (agpl)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 97.6K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

hypervisor file parsing, virtual machine disk analysis, hypervisor configuration parser, vm backup file extraction, dissect hypervisor forensics, forensics, hypervisor-parsing, incident-response

[View on SkillFed](https://skillfed.io/packages/dissect-hypervisor) · [View on PyPI](https://pypi.org/project/dissect-hypervisor/)