dissect.target

What it is and what it does

dissect.target is a forensic analysis framework that unifies access to various data sources in disk images, virtual machine snapshots, and file collections. It sits atop a collection of specialized Dissect modules (for NTFS, registry, event logs, hypervisors, and more) and exposes them through a consistent programming API and a suite of command-line tools. The package is designed for digital forensics and incident response workflows where analysts need to extract, query, and export evidence from diverse target formats.

The framework provides both programmatic access for custom analysis scripts and ready-made tools like target-query (for running plugin functions), target-shell (for interactive filesystem exploration), target-reg (for Windows registry inspection), and target-mount (for mounting filesystems). It handles the complexity of parsing different image formats and filesystem types, allowing users to focus on the forensic questions rather than format-specific parsing details.

Use it for:

• Query Windows event logs, PowerShell history, and command artifacts across multiple disk images using target-query plugins
• Interactively explore a suspect disk image filesystem and registry using target-shell commands like ls, cat, and registry
• Export forensic records (timelines, artifacts, logs) from targets to compressed archives for reporting with target-dump
• Mount a forensic image to your analysis machine for direct filesystem access without modifying the original evidence
• Develop custom Python scripts that parse and correlate data across multiple evidence sources using the dissect.target API

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

dissect.target provides a unified API and command-line tools to parse and query data from disk images, file collections, and forensic evidence formats, abstracting away the complexity of multiple underlying Dissect modules.

Yes, if you work in digital forensics or incident response. The package is actively maintained, has no known vulnerabilities, and provides a well-designed abstraction over complex forensic formats. The AGPL license is appropriate for internal tools and open-source projects but incompatible with proprietary distribution. Install with caution in closed-source environments or verify licensing constraints with your organization.

Install

dissect-target on PyPI

pip install dissect-target

uv add dissect-target

poetry add dissect-target

Installing dissect.target

Before you install

Low friction installation as a pure Python wheel. Active maintenance with recent commits and stable production status. Requires Python 3.10 or later.

License in practice

AGPL-3.0-or-later: copyleft license requiring derivative works to be released under the same terms and source code to be made available to users. Suitable for internal tools and open-source projects; not compatible with proprietary closed-source distribution.

Quickstart

pip install dissect.target

from dissect.target import Target

target = Target.open('/path/to/target.vmdk')
for fs in target.filesystems:
    print(fs)

Requires Python 3.10 or later. Some plugins (e.g., YARA support) require optional dependencies installed separately.

Verify before relying

• Whether all 12 runtime dependencies are required for basic functionality or if some are optional/plugin-specific
• Performance characteristics when working with large disk images or many targets
• Compatibility with specific forensic image formats beyond the examples in the description

Package facts

Evidence: dissect_target-3.25.1-py3-none-any.whl

Tags

More Utilities packages