ℹ️ Deprecation Notice: Python 3.9 Support
Starting with Dissect 3.20, we are officially deprecating support for Python 3.9, since it will reach EOL after October 2025. While it will still work in this release, beginning with Dissect 3.21, Our minimum python version will change to 3.10.
Highlights
Plugins and Usability updates
- Improve QCow2 to support automatic backing file resolution
- Parsing of negative numbers fixed and improved constraint parsing in SQL
- VMFS implementation rewritten from scratch, now supporting more datastore configurations
- DHCP lease file parsing functionality now available in the new Linx network plugin
- New support for voidtools everything DB
- New plugin for recentlyused.xbel files from Linux desktops
- Yara output support string matches (collaboration between two contributors!)
- Mounting btrfs sub-volumes with target-mount enabled
- target-dump argument parsing fixed
- Plugins can now re-use arguments that previously conflicted with tool arguments (e.g.
--json, previously had to be used in plugins as--as-json)
Development and performance
- As part of our ongoing performance improvements certain parts of dissect.util have been converted to use Rust
- Reduced memory consumption by extfs
Contributors
Thanks to our contributors for making this release possible:
@andkae
@andreia-oca
@B0TAxy
@cobyge
@JSCU-CNI
@lhaagsma
@M1ra1B0T
@Matthijsy
@MrYoranimo
@qmadev
@respondersGY
@reynas
@sMezaOrellana
@william-billaud
@YahavArm
@Zawadidone
Full Changelogs
dissect: 3.19 → 3.20
https://github.com/fox-it/dissect/releases/tag/3.20
dissect.archive: 1.6 → 1.7
https://github.com/fox-it/dissect.archive/releases/tag/1.7
dissect.btrfs: 1.7 → 1.8
https://github.com/fox-it/dissect.btrfs/releases/tag/1.8
dissect.cim: 💤3.12 (no changes)
https://github.com/fox-it/dissect.cim/releases/tag/3.12
dissect.clfs: 💤1.10 (no changes)
https://github.com/fox-it/dissect.clfs/releases/tag/1.10
dissect.cramfs: ✨1.0
https://github.com/fox-it/dissect.cramfs/releases/tag/1.0
dissect.cstruct: 4.5 → 4.6
https://github.com/fox-it/dissect.cstruct/releases/tag/4.6
dissect.esedb: 3.16 → 3.17
https://github.com/fox-it/dissect.esedb/releases/tag/3.17
dissect.etl: 3.11 → 3.13
https://github.com/fox-it/dissect.etl/releases/tag/3.13
dissect.eventlog: 💤3.10 (no changes)
https://github.com/fox-it/dissect.eventlog/releases/tag/3.10
dissect.evidence: 💤3.11 (no changes)
https://github.com/fox-it/dissect.evidence/releases/tag/3.11
dissect.executable: 1.8 → 1.10
https://github.com/fox-it/dissect.executable/releases/tag/1.10
dissect.extfs: 3.13 → 3.14
https://github.com/fox-it/dissect.extfs/releases/tag/3.14
dissect.fat: 💤3.12 (no changes)
https://github.com/fox-it/dissect.fat/releases/tag/3.12
dissect.ffs: 💤3.11 (no changes)
https://github.com/fox-it/dissect.ffs/releases/tag/3.11
dissect.fve: 4.2 → 4.4
https://github.com/fox-it/dissect.fve/releases/tag/4.4
dissect.hypervisor: 3.18 → 3.19
https://github.com/fox-it/dissect.hypervisor/releases/tag/3.19
dissect.jffs: 💤1.5 (no changes)
https://github.com/fox-it/dissect.jffs/releases/tag/1.5
dissect.ntfs: 💤3.14 (no changes)
https://github.com/fox-it/dissect.ntfs/releases/tag/3.14
dissect.ole: 💤3.11 (no changes)
https://github.com/fox-it/dissect.ole/releases/tag/3.11
dissect.qnxfs: 1.0 → 1.1
https://github.com/fox-it/dissect.qnxfs/releases/tag/1.1
dissect.regf: 💤3.13 (no changes)
https://github.com/fox-it/dissect.regf/releases/tag/3.13
dissect.shellitem: 3.11 → 3.12
https://github.com/fox-it/dissect.shellitem/releases/tag/3.12
dissect.sql: 3.11 → 3.12
https://github.com/fox-it/dissect.sql/releases/tag/3.12
dissect.squashfs: 1.9 → 1.10
https://github.com/fox-it/dissect.squashfs/releases/tag/1.10
dissect.target: 3.22 → 3.23.1
https://github.com/fox-it/dissect.target/releases/tag/3.23.1
dissect.thumbcache: 💤1.10 (no changes)
https://github.com/fox-it/dissect.thumbcache/releases/tag/1.10
dissect.util: 3.21 → 3.22
https://github.com/fox-it/dissect.util/releases/tag/3.22
dissect.vmfs: 3.11 → 3.12
https://github.com/fox-it/dissect.vmfs/releases/tag/3.12
dissect.volume: 3.15 → 3.16
https://github.com/fox-it/dissect.volume/releases/tag/3.16
dissect.xfs: 💤3.12 (no changes)
https://github.com/fox-it/dissect.xfs/releases/tag/3.12
