---
id: dissect-target
version: "3.25.1"
license: AGPL-3.0-or-later
license_treatment: agpl
maintenance: active
---

# dissect.target — This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)

License: agpl · Maintenance: active · Downloads: 528.8K/mo

## What it is and what it does

dissect.target is a forensic analysis framework that unifies access to various data sources in disk images, virtual machine snapshots, and file collections. It sits atop a collection of specialized Dissect modules (for NTFS, registry, event logs, hypervisors, and more) and exposes them through a consistent programming API and a suite of command-line tools. The package is designed for digital forensics and incident response workflows where analysts need to extract, query, and export evidence from diverse target formats.

The framework provides both programmatic access for custom analysis scripts and ready-made tools like target-query (for running plugin functions), target-shell (for interactive filesystem exploration), target-reg (for Windows registry inspection), and target-mount (for mounting filesystems). It handles the complexity of parsing different image formats and filesystem types, allowing users to focus on the forensic questions rather than format-specific parsing details.

Use it for:

- Query Windows event logs, PowerShell history, and command artifacts across multiple disk images using target-query plugins
- Interactively explore a suspect disk image filesystem and registry using target-shell commands like ls, cat, and registry
- Export forensic records (timelines, artifacts, logs) from targets to compressed archives for reporting with target-dump
- Mount a forensic image to your analysis machine for direct filesystem access without modifying the original evidence
- Develop custom Python scripts that parse and correlate data across multiple evidence sources using the dissect.target API

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

dissect.target provides a unified API and command-line tools to parse and query data from disk images, file collections, and forensic evidence formats, abstracting away the complexity of multiple underlying Dissect modules.

Yes, if you work in digital forensics or incident response. The package is actively maintained, has no known vulnerabilities, and provides a well-designed abstraction over complex forensic formats. The AGPL license is appropriate for internal tools and open-source projects but incompatible with proprietary distribution. Install with caution in closed-source environments or verify licensing constraints with your organization.

## Install

pip install dissect-target
uv add dissect-target
poetry add dissect-target

## Installing dissect.target

Before you install: Low friction installation as a pure Python wheel. Active maintenance with recent commits and stable production status. Requires Python 3.10 or later.

License in practice: AGPL-3.0-or-later: copyleft license requiring derivative works to be released under the same terms and source code to be made available to users. Suitable for internal tools and open-source projects; not compatible with proprietary closed-source distribution.

Quickstart:

pip install dissect.target

from dissect.target import Target

target = Target.open('/path/to/target.vmdk')
for fs in target.filesystems:
    print(fs)

Requires Python 3.10 or later. Some plugins (e.g., YARA support) require optional dependencies installed separately.

Verify before relying:

- Whether all 12 runtime dependencies are required for basic functionality or if some are optional/plugin-specific
- Performance characteristics when working with large disk images or many targets
- Compatibility with specific forensic image formats beyond the examples in the description

## Package facts

- License: AGPL-3.0-or-later (agpl)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 528.8K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

disk image forensic analysis, parse vmdk e01 targets, forensic evidence extraction, digital forensics framework, query disk image data, target filesystem access, forensic artifact parsing, forensics, incident-response, disk-imaging

[View on SkillFed](https://skillfed.io/packages/dissect-target) · [View on PyPI](https://pypi.org/project/dissect-target/)